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Foreword 


This history of the F-8 Digital Fly-By-Wirc Project at NASA's Dry den Flight 
Research Center by Dr. Janies E. Tomayko of Carnegie Mellon University is 
important for a number of reasons. Not the least of these is the significance of the 
program itself. In 1972 the F-HC aircraft used in the program became the first digital 
fly-by- wire aircraft to operate without a mechanical backup system. This fact was 
important in giving industry the confidence to develop its own digital systems, since 
flown on military aircraft such as the F-18. F-16, F-l 17. B-2. and F-22. as well as 
commercial airliners like the Boeing 777. Flying without a mechanical back-up 
system was also important in ensuring that the researchers at Dry den were working 
on the right problems. 

Today, digital fly-by-wire systems arc integral to the operation of a great many 
aircraft. These systems provide numerous advantages over older mechanical arrange- 
ments. By replacing cables, linkages, push rods, pull rods, pulleys, and the like with 
electronic systems, digital fly-by-w ire reduces weight, volume, the number of failure 
modes, friction, and maintenance. It also enables designers to develop and pilots to 
fly radical new configurations that would be impossible w ithout the digital technol- 
ogy. Digital fly-by-wire aircraft can exhibit more precise and better maneuver 
control, greater combat survivability, and. for commercial airliners, a smoother ride. 

The F-8 Digital Fly-By-Wirc Project made two significant contributions to the new 
technology: ( I ) a solid design base of techniques that work and those thit do not. and 
(2) credible evidence of good flying qualities and the ability of such a system to 
tolerate real faults and to continue operation without degradation. The narrative of 
this study captures the intensity of the program in successfully resolving the numer- 
ous design challenges and management problems that were encountered. This, in 
turn, laid the groundwork for leading, not only the U.S.. but to a great extent the 
entire world’s aeronautics community into the new era of digital fly-by-wire flight 
controls. The book also captures the essence of what NASA is chattered to do— 
develop and transfer major technologies that will keep the U.S. in a world leadership 
role as the major supplier of commercial aviation, military, and aerospace vehicles 
and products. The F-8 project is an example of how advanced technology developed 
in support of tlx: agency’s space program, in this case the Apollo endeavor, can be 
successfully transferred to also address the agency’s aeronautics research and 
development goals, greatly multiplying payoff on taxpayer investments and re- 
sources. It is truly an example of what NASA does best. 

Dr. Tomayko tells this story very effectively, which is another reason his history is 
important. For the first time, he makes the details of the development of digital fly- 
by-wire available in one place. Moreover, lie does so in a style that is both readable 
and accessible to the general reader. He brings to the task unique qualifications. 
Besides being trained in the history of technology and a seasoned author in that field, 
he also has over 20 years of experience in the computing industry and academia, 
where lie has taught and published about real-time systems and software engineering. 
This combination of talents and experiences has allowed him to tell an important 



story exceptionally well. I commend his book to anyone interested in the history of 
technology and/or aviation. 

Calvin R. Jarvis 

Former Director. Dryden Aerospace Projects 
30 August 1999 



Preface 


One hundred years after the Wright brothers' first powered flight, airplane designers 
arc un&hacklcd from the constraints that they lived with for the first seven decades of 
flight because of the emergence of digital fly-by- wire (DFBW) technology. 

New designers seek incredible maneuverability, survivability, efficiency, or special 
performance through configurations which rely on a DFBW system for stability and 
controllability. DFBW systems have contributed to major advances in human space 
flight, advanced fighters and bombers, and safe, modem civil transportation. 

The story of digital fly-by-wire is a story of people, of successes, and of overcoming 
enormous obstacles and problems. The fundamental concept is relatively simple, but 
the realization of the concept in hardware and software safe enough for human use 
confronted the NASA-industry team with enormous challenges. But the team was 
victorious, and Dr. Tomayko tells the story extremely well. 

The F-8 DFBW program, and the technology it spawned, was an outgrowth of the 
Apollo program and of the genius of the Charles Stark Draper Laboratory staff. Tire 
DFBW program was the high point of my own career, and it was one of the most 
difficult undertakings of the NASA Drydcn Flight Research Center. It was not easy 
to do the first time in the F-8 and it will not be easy to do in the next new airplane. I 
hope the history of this program is helpful to the designer of the DFBW systems 
that will enable new 1 and wonderful aerospace vehicles of the future. 


Kenneth J. Szalai 

F-8 DFBW Principal Investigator 

Former Director. NASA Dry dcn Flight Research Center 

5 October 1999 
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Introduction: 

The Promise of a New Flight Control Technology 


The 25th of May 1972 was a typical day at Edwards Air Force Base in the high 
desert of California: sky brutally blue, light winds— perfect flying weather. In the 
25 years since Chuck Yeager had broken the sound barrier there in the X- 1 . the 
Edwards main tunway and the surrounding dry lakcbcds had seen more than their 
share of exotic Hying machines. Some, like the X-l and the X-15. were highly 
successful, while others failed miserably. Today it was not an X-plane that taxied 
slowly to the end of tunway 04. but a rather conventional-looking F-8C fighter 
whose appearance belied its internal modifications. In fact, it was the first of the F- 
8C designation, built in 1958. Despite its unassuming appearance and vintage, this 
airplane would usher in a new era in aviation — the era in which flight control would 
revolve around a digital computer, and the pilot's inputs made through stick and 
rudder would be a small part of a flood of data from sensors and switches that 
enable the computer to stabilize an unstable airplane. Successful tests w ith this 
conventional airframe would pave the way for the unconventional: the Space 
Shuttle Otbiter. the B-2 flying wing, and commercial airliners like lire Airbus A-320 
or Boeing B-777 with smaller, lighter control surfaces and almost unimaginable 
reliability. 



Research plot Gary Krier climbs rtto the cocfcpt o* the F-8. Me eventually Dew 64 missions, 
more than any other pilot rt the project. (NASA photo E-24682|. 
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For NASA research pilot Gary Kricr. this was all far in the future, though not as far 
as the engineers on the digital fly-by-wire project thought. He was more interested 
in the next hour of flying. Krier had significant flight experience, including flying 
chase for the X-15. He called that job a "rite of passage.” meaning he had "arrived" 
as a member of the small fraternity of test pilots. A slim, brown-haired 38-year-old 
who looked at least 10 years younger. Krier was facing his first research program as 
project pilot. Krier knew that thorough preparation was the best foundation for a 
safe flight. He had "flown" over 200 hours in the "Iron Bird” simulator that repli- 
cated the hardware and software in a modified F-8 airframe sitting in a hangar. 

Krier also flew practice missions in an unmodified F-8. NASA 816. convincing 
himself that if he had engine power and rudder authority he could land on one of the 
many lakebed runways scattered throughout restricted area R-2515. He also knew 
that there were two fly-by-wire systems on board, in case one of them failed. The 
primary was centered on an Apollo Guidance Computer of the type used on the 
lunar lander. The secondary was a three-channel redundant electronic analog 
computer system like those pioneered by the German engineers who built the A-4 
(V-2> in World War II. 

What prompted NASA's engineers to put a digital computer in an airplane? They 
hoped it would be the next victory in the aeronautical designer*' perpetual war 
against si/.c and weight, while gaining considerable advantages in maneuverability 
and safety. An aircraft has only two fundamental tugs-of-war among four forces to 
deal with: thrust versus drag and lift versus weight. The NASA project concentrated 
on the second conflict. By actively controlling an aircraft's surfaces automatically, it 
is possible to stabilize it artificially, thus reducing the need for horizontal and 
vertical stabilizers with large surface areas. In military fly ing, this means higher 
thrust-to-weight ratios and greater weapons loads: in commercial fly ing it results in 
more paying passengers. 

At around 10:00 a.m.. Krier taxied onto runway 04. Even though the prevailing 
wind usually favors runway 22. the opposite is used for first flights since it has 
thousands of feet of empty lakebed at the end of its length of 15.000 feet; enough 
room for a straight-ahead emergency landing if something strange happened on 
takeoff. Despite the presence of the backup flight control computer, no one wanted 
to test it for the first time close to the ground. At 10: 14. Krier applied full power and 
the F-8C. painted white with blue lightning bolts on its sides, launched itself, its 
pilot, and the w orld into the digital era of aviation. 

NASA's digital fly-by-wire project is remarkable for its impact on the evolution of 
flight control systems but is also a case study in how engineers sold ideas and 
conducted research at the NASA Right Research Center (redesignated the Drydcn 
Flight Research Center in 1976) during the late 1960s and throughout the 1970s. 
Arguably, the fly-by-wire project could not be done as easily today sinec the 
channels for selling project ideas and obtaining funding arc more complex now. 

This is due to formality and layers of bureaucracy that did not exist in the 1960s. 
Even in the personnel-bloated Apollo era. NASA engineers knew their I read quarters 
counterparts informally . If a proposed project could get past the Center director and 
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find a champion at headquarters, the engineers and their advocate could usually 
work out a proposal that would sell, even if the resulting funding was little more 
than a start. Projects that capitalized on the seed money w ould, if not prosper, at 
least survive. As Krier climbed out to the multicast, tire re was no doubt that the fly- 
by-wire project had spent its startup money well. Furthermore, the working atmo- 
sphere at the Flight Research Center emphasized cooperation and teamwork by all 
members of a program. Pilots w ere actively involved in design and planning; crew 
chiefs, hardware and software people, everyone collaborated to create a successful 
project. Twenty-five years later. NASA Administrator Daniel Goldin launched his 
“faster, better, cheaper" campaign and visited all the Centers to explain it in a series 
of all-hands meetings. He found that the atmosphere he was trying to create at 
NASA already existed at the Dryden Right Research Center as the established way 
of doing business. 

Pan of the reason that the fly-by-wire project remained cost-effective is that the 
Dryden engineering team chose to be the system integrators, rather than passing that 
responsibility to a prime contractor. Aside from saving money. Dryden gained 
immeasurable experience working with diverse suppliers and computer software. 
This experience grew throughout the program and was passed on to other projects at 
the Center. 

Another notable feature of the fly-by-wire project was live extraordinary quality of 
the engineers, pilots, and support personnel who worked on it. Toward the end of 
the first series of flight tests, pilots from other projects were brought in to check out 
the airplane. They commented in their flight reports that the project team was 
performing at a first-class level in all aspects. Many of the key engineers went on to 
greater responsibility, including Ken Szalai. the lead research engineer who became 
Center director in 1994. The "F-8 Mafia." as some Dryden employees referred to it. 
represented a stable group of NASA engineers with over three decades of experi- 
ence. a situation increasingly rare in the downsized and probably younger NASA of 
ttxlay. They were far removed from an "old boys’" network, they had achieved their 
positions of leadership through merit. 

Finally, aside from carrying out the model "good” project of the 1970s in achieving 
its own objectives, the team was able to aid the Space Shuttle group in gathering 
experience with new flight computers and eliminating problems that came up in the 
Approach and Landing Tests conducted at Dryden. Without the F-8 ready to fly 
support missions, the Shuttle project would almost cettainly have suffered costly 
and frustrating delays. The F-8 also flew with a prototype of the sidestick planned 
for use in the F- 16. These pieces of technology transfer were only a part of the wide 
dissemination of results that occurred in papers and industry workshops. The 
Dryden engineers were thereby able to convey their confidence in fly-by-wire to 
reluctant commercial airplane builders. 

Many technologies with significant advantages fail to catch on due to economic 
constraints, or sometimes simply because their time has not come. Fly-by-wire 
demonstrated that its time had come. Within 10 years of Krier's pioneering flight, 
digital controls were the only technology used in designing the world's military 



aircraft The premier warplanes designed in the 1980s. the B-2 flying wing and the 
F-22 stealthy air-superiority fighter, are both naturally unstable and take advantage 
of the active control provided by digital fly-by-wire. In a sense, the B-2 is the 
ultimate demonstration of the conventional cruciform tail reduction that is possible 
with fly-by-wire: the tail is gone, so there is no passive stabilization. Although not 
as radical as the B-2. the first commercial aircraft with digital flight controls was 
also designed within a decade of the initial flight of the modified F-8. The Airbus A- 
320. which has provided a clinic for cockpit designers through its various crashes, 
has a high level of success with its control sy stem, which features a unique architec- 
ture to enhance reliability. The Airbus flight control system has migrated to all new 
models of that firm's aircraft. Even the conservative industry dominator. Boeing, 
has launched the B-777 w ith a digital control system of more conventional design. 



The (notified F-fl dimbs ink) the future of Might control. (NASA (Wolo ECN-3312). 


Participants in the NASA program arc uniformly amazed at the rapidity of the 
transfer of this technology. There were other predecessor and contemporary fly-by- 
wire programs, and the combined weight of everyone's results no doubt contributed 
to the widespread use and acceptance of the technology. However, live engineers at 
the Right Research Center were the first to use digital computers, and these are the 
choice of nearly all designers now. They were tire first flight-control team to 
struggle with that troublesome, intractable medium: software. They clearly demon- 
strated that it was possible to build and integrate a combined hardware and software 
flight-control system, and that it had all the advantages expected of fly-by-wire with 
additional flexibility provided by embedding the flight-control laws in computer 
code. The world was apparently ready, and now the skies arc filled with digital 
computers flying "in very tight formation." This book tells their story . 





Chapter One: The History of Flight-Control Technology 


When NASA’s Flight Research Center entered the field of active control 
research, it stixid at a crossroads reached by previous work. Flight -control 
philosophies hail progressed through several stages of emphasis on inherent 
and dynamic stability to instability. Flight-control technology initially had 
limited mechanical means and a great dependence on the pilot. By 1960, 
control of both unpilotcd missiles and automatic control of piloted aircraft 
greatly reduced this reliance. A technology called "fly-by-wire" — due to its 
electrical, rather than mechanical, nature — made these accomplishments 
possible. Fly-by-wire was not fully born of itself. At first, it was the solution 
to a set of control problems — a fix. not considered an earth-shaking discov- 
ery. Later, as its true potential was revealed, researchers at NASA, the Air 
Force, and elsewhere began to build flight-test programs around fly-by-wire 
in order to exploit it more effectively. NASA, however, took a road different 
from the others. This book examines the history of control technology and 
early fly-by-wire to understand why. 

The Flight-Control Problem 

When you consider the relatively simple technology that went into the 
Wright Flyer, you might wonder why it took so long to achieve powered 
flight. A number of inventors and researchers were very close to beating the 
Wrights into the history books. The stumbling block facing the brothers and 
their competitors was the inability to maintain even straight and level flight 
without extreme effort. At a meeting in Chicago of the Western Society of 
Engineers in September of 1901. Wilbur Wright summarized the situation: 
‘inability to balance ami steer still confronts the students of the flying 

problem When this one feature has been worked out. the age of flying 

machines will have arrived, for all other difficulties arc of minor impor- 
tance." 1 Ironically, the Wrights would “solve" the problem by reliance on the 
skills of the pilot. Seventy years later, the computer would move in for 
humans as the cornerstone of the solution. 

The Essence of “the Flying Problem” 

Until the early nineteenth century, fledgling aeronauts thought the 
solution to what Wilbur Wright termed “the flying problem” lay in imitating 
the birds. The Icarus legend and Leonardo da Vinci’s stiff-winged, human- 
powered flying harness arc examples of how even the most creative people 


1 Wilbur Wnght bclorc It,- WeMcra Society of Engineer*. Chicago. IS Sep. 1901. at quixed in Dim* 
NfcRucr and Dunum Graham. 'Eighty Year* of Plight Control: Triumph* and Piltall* at if* Syttcmt 
A [preach.' in Journal < 1 / Gutdatice and Control. 4 1 July- Aug I9SI): J5.1-.I62. 





Very ixislaUe in pitc*i. sooiewhai unstable rt roll, and sightly unstable in yaw. Ihe Wright Flyer 
look constant intense concentration and great skil lo tty. It is no «vonder that its longest tight 
lasted a mere 59 seconds. iPhoto courtesy ol the Srrlthsorlan Institution). 

centered tin a natural dead end. The interplay of forces seemed impossible to 
figure out. Weight, drag, and thrust were easy enough, hut overcoming 
weight to achieve lift seemed to be a matter of exerting sufficient downw ard 
thrust— impossible to achieve by a human or early mechanical systems. 

Nevertheless, things '‘new'': pieces of paper, kites, and other rigid or 
semi-rigid objects dependent on random gusts of wind. Finally, in the early 
years of the 1800s. the Englishman George Cayley figured out that a rigid 
plane moving through the air generates lift, and the world changed. For the 
remainder of the century the problem shifted to the need to provide sufficient 
airflow over planar "wings” to generate enough lift to balance the weight of 
the aircraft. Even a flat surface gives the lifting effect if sufficient forward 
speed is applied. J As some wags used to say about stocky jet fighters. "Even 
a brick can fly if you hang a big enough engine on it.” 

As work progressed, researchers found out that making the wing flat on 
the bottom and curved on the top helped generate more lift with less thrust. 
This is the shape of airplane wings today. The differences in the thickness of 
the wing arc a function of the forw ard thrust: more thrust, thinner wings. This 
is why jets have thinner wings than piston-driven airplanes. 

Sir Hiram Maxim, probably better known as the inventor of an effective 
machine gun. used the profits from his invention to study flight. He built an 
enormous aircraft that actually lifted a few inches off its long launch track. 
The emphasis of his research was directed at the power plant (perhaps 


•’ Chart* Suit Dupci. " Flight Control." 43rd Wllhur Wright Mcirxrul Lecture, Journal of i hr Royal 
Atnmauriral Snarly. 59 (July 1955): 451-478. 



naturally, given his mechanical talents). Other experimenters, such as Otto 
Lillienthul. Percy Pilcher. Octave Chanutc. Samuel Pierpont Langley, and 
Charles Manly, concentrated on improving lilting surfaces. Their gliders 
achieved high degrees of inherent stability, or the tendency to maintain 
straight and level flight given constant acceleration. They evidently thought 
that this was a desirable trait, pcihaps driven by the fact that their early 
models were unpiloted, and the intended demonstration was of steady lift. 1 

The problem with inherent stability is that it has a double-edged nature. 

It causes the aircraft to respond quite strongly to gusts, making it difficult for 
the human pilot to control the response. Glider pilots of the era had to 
balance and steer by shifting body weight. Ironically, both unstable and 
stable designs required the athletic ability of a gymnast to achieve the same 
effect. One of the key difficulties was achieving static longitudinal stability, 
or the ability to stay balanced fore and aft. This form of stability is least in 
low-winged monoplanes at low speeds, which pretty much characterizes the 
situation of most of the gliders.' Maxim experimented with biplane designs. 
He reasoned that they essentially doubled the leading edge of the wing 
without doubling the physical width of the airframe. Biplane designs also 
reap some stability gains.' 

The difficulty of achieving stability frustrated the aeronauts to the point 
where Wright made the statement quoted above, and leading aeronautical 
theoretician G. H. Bryan intoned: "The problem of artificial flight is hardly 
likely to be solved until the conditions of longitudinal stability of an 
aeroplane system have been reduced to a matter of pure mathematical 
calculation." 4 Bryan made this particular prediction in June of 1903. and it 
was published on 7 January 1904, precisely three weeks after the Wright 
brothers "solved" the "flying problem" once and for all. 

The Wright Solution 

It is difficult to imagine a more unstable vehicle at low speeds than the two- 
wheeled bicycle. Even so. most of us cannot remember what it was like to 
learn to ride one. once the integration of balance, steering, and forward speed 
is accomplished and practiced. When the bicycle-building Wright brothers 
turned their restless inventiveness toward the "flying problem." they initially 
thought that the other aeronauts were past the training-wheel stage, and they 
worried that they were behind. There existed equations of lift and notions of 


Chute* Stark Draper. llifhi Control." pp. 455. 460. 

1 Melvin Gough. "Nine* im Suhtlily trom the Pilot'* Standpoint." loiintal of the Aen-Muuilrirf Setenrei 6. 
«*i. Kl (Aug. 19391: 396. 

‘ Hiram S. Maxim. AnifHlal aaJ Naluml fHfhi (Ltadon: What ale*. IS09>.p. 100. 

- C.H. Bryan and W.E. W ilium*. "Th; Longitudinal Stability of Aerul Glxbrv' Pmeedmgt of the Royal 
.Soeur. <y L.MvJ.il. 7.1 (19041: Ittl. 

Orville Wrlgt*. Him Me Imented lltt At/plane, FredC. Kelly, cd. I New York: David Mu: Kay. I953l i* a 
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stability, even the concepts of wing warping and vertical and horizontal 
stabilize rs. 

When the Wrights tried to apply their competitors' previous work to their 
own glider., they found enormous knowledge gaps. They used models and 
full-size gliders, both piloted and unpiloted. and even had to develop a wind 
tunnel to settle airfoil design questions. This step-by-Step exploration took 
several years, each one punctuated by an extended field trip to Kill Devil 
Hills in North Carolina to ride the steady winds available there. 

At first, the Wrights tried the stability solution, following the lead of their 
immediate precursors.* As they gained more experience, they began to build 
their gliders with less stability, depending on the pilot to compensate. Later. 
Charles Stark Draper, the engineer who led the development of the Apollo 
lunar spacecraft control system, would point to this decision as the key 
contribution of the Wrights to aeronautics. They believed in the concept of a 
stable system made up of machine and pilot as opposed to simply a stable 
airframe. 1 ' The center of the problem thus shifted from determining and 
maintaining some form of inherent stability to that of allowing dynamic 
stability within controllable limits. Likewise, the emphasis of their work 
changed from stability to control, opening a door through which computer 
technology would later walk. 

Research done after the Wrights achieved flight clearly showed that 
oscillations along the longitudinal axis of an aircraft arc more easily damped 
by pilots than arc lateral oscillations. 1 " It is therefore not surprising that the 
Wrights solved the longitudinal control aspect first. They added a lever that 
moved the horizontal stabilizer located in the front of the pilot, who lay on 
the lower wing. The large surface area of this bi-plancd stabilizer —and the 
fact that both of the small wings moved together — made it fairly powerful 
as a control surface. 

The lateral stability problem, especially in turning flight, took longer to 
solve. First the inventors tned to use wing warping alone, placing a cradle at 
the hips of the pilot to control the wires leading to the trailing edges of the 
wings. After a disastrous flight or two they hit upon the idea of coupling the 
wing warping to moving the previously fixed vertical stabilizers mounted 
behind the wings. This scheme enabled coordination of forces resulting in 
smooth banking turns. 

The dependable December breeze was moving at a brisk 27 milc-pcr- 
hour clip the day the Wright Flyer sat on the launch rail, ready for its rendez- 
vous w ith aviation history. Orville Wright lay on the vibrating w ing, hips 
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centered in the lateral control cradle, thoughts of Wilbur’s failure to control 
the plane three days before clouding his confidence. With the wind at a peak 
gust, the twin propellers buzzing, and his brother steadying the right wing, 
Orville accelerated down the single rail gathering speed until the Flyer lifted 
into the air and flew for some seconds toward a controlled landing in the 
sands. 

The Wrights had made their point: full inherent stability was not a 
prerequisite for practical flight. This news did not sit well with the other 
aviation pioneers who labored long on the same path. Maxim seemed least 
likely to admit to reality. He repeatedly called them "the mysterious Wrights" 
and stated that "there is much doubt about their alleged flights" even as 
Wilbur and Orville were steadily piling up time and distance records back 
home in the gray Ohio skies." As long as fuel tanks quickly ran dry and 
visual flying was the rule, the lack of inherent stability inhibited no one 
trying to advance the art of flying. 

The Return of the Stability Paradigm 

For over twenty years after Kitty Haw k, aircraft of widely varying 
stability came into common use. Some of the pilot favorites, such as the Spad 
and the Curtis JN-5 Jenny, were among those unstable in one axis or another. 
The development of aeronautical engineering was still at the craftsman stage. 
Bryan’s and others’ attempts to derive the mathematical equations of stability 
and lift met with mixed success. Bryan himself reasoned that people did not 
study mathematical descriptions of stability simply because of the actual 
success of machines without inherent stability. 1 * 

It is interesting to review the state of the airplane design art as it stood in 
about the middle of World War 1. F.S. Barnwell produced a slim volume that 
led the reader step-by-step through the design of an airplane, with an ex- 
tended appendix by W. H. Sayers that summarized the understanding of 
stability at that time." Sayers makes it clear that inherent stability as a 
concept was not perfectly understood. The terminology used to describe it 
was not standard, or even unambiguous. For instance, within the range of 
"stable” aircraft were those that were “livelier" due to the concentration of 
weight near their centers and those that were "steadier” due to distribution of 
weight. In the former, small forces had a greater effect than in the latter. The 
range from "livelier’’ to "steadier” is not defined. 

During the 1920s aeronautical engineers began to gear their designs back 
toward the idea of inherent stability. The reasons arc obvious to any automo- 
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bile driver on a mid western interstate: long stretches without outside stimula- 
tion. such as distance Hying at night, tend to increase fatigue. As ranges of 
aircraft increased, the need to make them easier to fly also increased. The 
inability to let go of the controls for even a few seconds works against these 
objectives. Also, the more stable an aircraft, the easier it is to build a practical 
autopilot. 

There was a debate early in this century between w hat Charles H. Gibbs- 
Smith calls the "chauffeurs" and the "airmen." 1 * For the former, airplanes 
ought only to be steered, much like an automobile. For the latter, they must 
be piloted, like the Wrights flew theirs. After some years of dominance by the 
airmen, the less talented and more practical wanted a chance at flying for the 
business of moving cargo and passengers— tasks better fitted to sedate 
aircraft with “cruise-ship" handling characteristics. The result was a proces- 
sion of frankly overbuilt machines with large stabilization and control 
surfaces. However, new demands and the potential for remarkable perfor- 
mance improvements started the pendulum swinging back the other way. 

The Benefits of Abandoning Inherent Stability 

With an Me 109 on your tail spitting lead at a thousand rounds a second, 
you cease to be interested in how easy it is to fly a particular airplane straight 
and level and become radically more concerned about how easy it is to 
maneuver it in a rapid and unpredictable manner. The simple fact is that if the 
aircraft is too stable, it is more difficult to maneuver in certain desirable 
ways. It was recognized as early as Barnwell’s 1917 manual of airplane 
design that "too much inherent stability should not be given to an airplane." 15. 

Research studies made just prior to World War II bore this out. Engineers 
realized that "The idea that the easiest airplane to fly is one that will fly itself 
was proven false many years ago.""’ They discovered that pilots preferred 
aircraft with some lateral instability. Even modern light planes flown by 
recreational pilots do not return to complete wings-levcl flight after being 
disturticd by a wind gust. 1 To achieve that level of stability requires in- 
creases in the size of vertical stabilizers, and thus more weight and drag. 1 ’ 
Basically, "the greater the stability, the more demands placed on the pilot and 
the rougher the flight." 1 ® 

The understanding developed that the real need was for a degree of 
dynamic, rather than inherent, stability — that is. that the aircraft return to 
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straight and level flight after a disturbance in a "reasonable" period of time. 
The oscillation (disturbance) in question here is referred to as the “phugoid" 
motion, and it has been the subject of considerable experiment and analysis 
ever since. 5 ' 

However, the small degree of instability designed into most airplanes 
would not help much in evading the Messcrschmitls of World War II. and 
certainly not the F-15s and their missiles in the present world. Also, as World 
War II came to an end. the familiar airplane silhouette of wings, tail, and 
propeller encountered a revolution as proplcss turbojets laced the sky over 
Germany, quickly followed by tailless delta-w inged craft. As aircraft perfor- 
mance saw sudden improvement (cruising speeds doubled in less than a 
decade), new problems of stability, control, and maneuverability came to the 
fore. 

Also, being able to fly into the transonic region (on either side of the 
speed of sound) caused even more control headaches because of the rearward 
shift in the center of lift. 21 In the postwar period, researchers and designers 
realized that the solution to the control problems of supersonic flight and the 
demands for maneuverability in new aircraft lay in building planes that were 
less stable, or even unstable in one axis or another. It was one thing to settle 
on a design and degree of passive stability when the operational speed range 
was 100 knots, and another when it was 1 .000. 

In addition to making it easier to design aircraft to operate over a wider 
performance range, abandoning inherent stability made it possible to reduce 
size and weight, those twin obstacles to even greater performance. All 
aircraft depend on balancing weight with lift and drag with thrust. The 
heavier the weight, the greater the lift needed, and thus, with thrust held 
constant, a larger wing size is required. That means even more weight and 
drag. Similarly, the more drag there was from "useless" appendages (such as 
external weapons stores or cargo pods), the greater the need for more thrust. 
By allowing instability in one axis or another, the size of the horizontal and 
vertical stabilizers could be reduced, saving both size and weight. This 
allowed a performance gain with no increase in thrust and lift.” The savings 
achieved by relaxing the stability requirements can be quite remarkable. 
Boeing studied converting its KC- 135 Stratotankcr to a relaxed stability 
aircraft and estimated a 25 percent decrease in airframe weight with no loss 
in payload capacity. 2 ' 
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The airplane in Figure la demonstrates the situation in an inherently 
stable aircraft. '* The center of gravity is forward of the center of lift, so the 
aircraft would tend to pitch nose-down if it were not for airflow pushing 
downward on the horizontal stabilizer. The negative result is that this con- 
figuration requires relatively large horizontal surfaces, with the accompany- 
ing increases in size and drag. 



Line drawngi I a.lb. end 1c wigriady created by tbe authc* and converted to electronic (cental 
by Hie Drydeo Graphics Olfice. 

Figure lb shows the ease of a longitudinally unstable aircraft. Here the 
center of gravity is behind the center of lift. The horizontal stabilizer is now 
free to produce positive lift, allowing not only a smaller tailplane. but also 
smaller wings, because all the horizontal surfaces arc now overcoming the 
weight of the aircraft. Mov ing the center of gravity aft actually increases the 
range of an aircraft, other things being equal, because it allows more efficient 
use of thmst. This is especially true when going supersonic.^' 
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canard configuration.' 11 In this case the aerodynamic center of the aircraft is 
moved forward due to the lifting surface of the canard. This makes the center 
of gravity virtually move aft, increasing maneuverability without physically 
moving the center of gravity. 27 There arc many maneuverability advantages 
to the use of canards, including making it very difficult to stall the aircraft. 
However, the resultant configuration is also inherently unstable. To use the 
advantages of new technology and inherent instability, some form of active 
control must be provided, and only computers were fast enough to help. 

The Concept of Active Control 

As we have seen, the trend in airplane design was from less stable, pilot- 
controlled aircraft, toward more stable, less pilot-work-intensive aircraft. The 
decision to adopt unstable designs in order to increase performance, however, 
could not simply occur with a greater pilot workload. In fact, with greater 
performance, the aircraft exceeded the capability of human pilots to control 
them without some mechanical aid. It is one thing to bring a Jenny moving at 
70 knots in a light wind back to straight and level flight by pilot control, but 
quite another to stabilize a jet fighter at 1 .000 knots, or a large aircraft with 
plenty of inertia. There is simply not enough time for a human being to react. 
Therefore, the trend reversed from emphasizing stability to emphasizing 
control. 

Initially, control augmentation took the form of extending the pilot’s 
powers in some way. As an example, most light general-aviation aircraft use 
simple cable systems to connect control surfaces to the control yoke. The 
pilot physically moves the surfaces using human strength. Place the same 
pilot in a large commercial aircraft with control surfaces weighing thousands 
of pounds, moving in a 500-knot slipstream, and even a powerlifter would 
have trouble moving the control surfaces through direct cable connections. 
The solution is to install hydraulic systems much like the power steering in a 
large automobile. Other types of these systems were used to maintain level 

"RB. Jenny. F.M. Krulmulcil. and SA ljlixir. "Air Sopefixky with Control Configured FighiciN. 
AIM lounutl t/fAInra/l (May 1972 J: .171 
”IM.. p.373. 



flight. For instance, some high-performance jets such as the Boeing B-47 
bomber needed dampers in one axis or another to maintain stability since 
even small design discrepancies translated into big control problems. 

These systems form the basis of what was to come in the fully computer- 
ized era. but in themselves they could not do the job. For instance, in a 
variable-geometry aircraft such as the F-l 1 I. F-14. or B-l. the pilots would 
have a different “feel" as the wings changed the shape of the overall aircraft. 
These aircraft have "stability augmentation systems" that essentially make 
the pilot-aircraft interaction feel the same no matter what the position of the 
w ings. The development of these systems forced the inclusion of sophisti- 
cated feedback mechanisms and paved the way for the next innovation: the 
actively controlled airplane. 

In essence, the true advantages of instability can only be realized if the 
pilot is not aware that his airplane is unstable. This means that some method 
of ensuring stability without constant pilot attention must be used. The 
solution lies in active control systems that arc made possible by the applica- 
tion of computers to monitor and create the necessary feedback. Not only do 
these fly-by-wire systems compensate for instability, they open up a frontier 
of previously unthought-of improvements in handling, safety, and utility. 
Aside from reducing weight, as we saw above, the application of active 
control has had other positive results. For instance, engines can be smaller 
due to the reduced weight and drag of the airframes, even without sacrificing 
maneuverability* The weight and balance problem caused by having both 
internal and external weapons stores is solved because the control system 
automatically compensates for differences in llying characteristics as the 
center of gravity shifts.* 

However, the most valuable benefit of using active control is that aircraft 
w ith highly desirable characteristics such as stealth would simply be impos- 
sible to Hy otherwise. The Lockheed F-l I7A. which has proved in combat to 
be an effective fighter-bomber, is known among its pilots as a smooth Hycr. 
despite the inherent instabilities of its airframe and the multiplicity of radar- 
dcllcctivc surfaces that also dcllect smooth airflow over the fuselage.* 1 
However, new technologies of active control, like sensors, actuators, ami 
computers, needed to evolve before such planes could be built. 

Fly-by-wire became possible due to the convergence of existing llight- 
control technology and specific research and development of sensors, effec- 
tors. ami computers. Rcscarchcis knew they would need certain components 
to make active control systems. NASA and the Air Force then pursued these 
"enabling technologies." The result was a unifying system that has made 
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such innovations as side-stick controllers, high-g cockpits, and integrated 
engine and (light controls practical.' 1 

Control augmentation began as early as the 1 890s with Hiram Maxim's 
experiments with his rail-launched airplane. He devised a gyro device to 
steady the control surfaces, maintaining longitudinal stability.'* In the 1920s 
and 1930s, Elmer Sperry and others pioneered the design and use of autopi- 
lots. The seemingly primitive mechanical versions of these reached an apex 
in the late 1940s when a C-54 aircraft Hew from Newfoundland to England 
entirely under the control of a (light program on punched cards. 11 The 
amazed pilots were limited to “tending the store." much as they do in this day 
of (light management systems and digital autopilots. 

As high-performance aircraft became the norm, control augmentation 
based on electrical analog devices advanced the technology of active control. 
The Anglo-French Concorde supersonic airliner is an example of the applica- 
tion of active control in the transonic flight regime. The next steps, to fully 
fly-by-wire systems and then to the integrated flight and engine controls of 
current aircraft, were relatively short. Furthermore, they benefited from the 
application of systems built for space (light. The development of this technol- 
ogy has caused an evolution for the role of the pilot. The pilots have gener- 
ally accepted their new role as "systems manager.” The practical application 
of digital computers in the heart of these integrated navigation, stability, and 
thrust management networks has helped them in their transition. ' 1 

Active Control in History 

The key difference between mechanical control systems and (ly-by-wire 
systems is that the former arc distance dependent and the latter are force 
dependent." A pilot pulling back on the control wheel of a light plane 
deflects the elevators upward. The distance the elevators move is propor- 
tional to the distance the control wheel is pulled away from the instrument 
panel. The actual proportions arc a function of the cable length connecting 
the control wheel and control surface. 

In a (ly-by-wire system, the control device is usually a stick, either in the 
normal bctwccn-thc-lcgs position or on the side armrest. Depending on the 
type of sensor used, either the distance of deflection of the control stick or 
the force applied by the pilot's hand is measured. This measurement is what 
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is communicated to the computer system as the pilot’s desires. This makes it 
possible to control the motion of an aircraft, rather than the surface positions 
of the elevators, rudders, and ailerons.'® The result is a new way of piloting. 
The transition from the old control-centered style to the new is best illus- 
trated by some examples from history. The examples take us from children’s 
vehicles to the moon. 

Bicycles 

When Charles Stark Draper gave the annual Wright Lecture to the Royal 
Aeronautical Society in 1955. he chose the title "Flight Control” and spent a 
considerable portion of the talk discussing the Wrights’ decision to allow 
some instability in their Hying machine.' Afterwards. A. R. Collar of the 
University of Bristol commented to the audience. "The Wright brothers, 
before they became interested in aviation, were manufacturers of bicycles, 
and of all the unstable machines. I do not know of one more so than the 
bicycle.” So. how is it possible to control one? 

The bicycle is limited to motion in two-dimensional space. In steady 
state, with thrust applied through pedaling, the vehicle moves along on two 
wheels with little difficulty. However, the beginning rider quickly learns that 
the initial startup is the most unstable phase of a bicycle trip. Before cruising 
speed is attained, the rider struggles with the shift of body weight to each 
side of the spinning wheels and the uneven thrusts of legs on pedals. 

On a bike the rider is the sensor suite, central computer, and actuator for 
the bicycle control system. By shifting body weight, applying thrust, and 
steering, the rider eventually overcomes the instability of the bicycle and 
creates a dynamically stable moving system. Even though it is easier to 
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balance the bicycle on its wheels when in steady motion, the ndcr still has to 
apply control forces for maneuvers such as turns. Not only must the front 
wheel be turned in the desired direction, but the weight of the rider must also 
be shifted to balance centrifugal forces. No matter how unstable the bicycle 
is. few potential riders fail to advance beyond the training wheel stage, 
though many have scrapes and contusions as evidence of difficult lessons 
learned. 

It was this very method of weight shifting and control manipulation that 
made the flights of late nineteenth-century gliders and the early twentieth- 
century Wright powered airplanes possible. The Wrights learned to fly much 
like a child learns to ride a bike: the picture of one brother racing alongside 
the wing of the flyer balancing it for the other brother during the build up to 
takeoff speed is reminiscent of a parent running w ith a young rider, offering 
instructions and encouragement. Eventually the minds of men turned to the 
construction of flying machines without pilots, and the technology that led to 
fly-by-wire control began to develop. 

The German A-4 Rocket (V-2> 

The interwar years in Germany saw a great upsurge of glider flying. Shack- 
led by the Versailles Treaty, which restricted the construction of powered aircraft, 
the government encouraged gliding w ith the intention of building a strong base 
of pilots for the future Luftwaffe. A young student at the Technical University of 
Darmstadt. Helmut Hocl/cr. was caught up in this fad." 

One day while soaring he thought about the limitations of his instru- 
ments. In his mind he began to fashion an electrical network that would 
result in the instantaneous calculation of the true velocity of his glider: that 
is. the velocity without wind effects. Thinking that this would be a great topic 
for one of his academic requirements. Hoe l/e r approached an assistant 
professor named Kurt Debus (ironically, later the director of the Kennedy 
Space Center) and asked for some small funding to buy pa its. Debus turned 
him down, citing lack of money and the "tremendous difficulty” of the task. 

Hocl/cr reluctantly put the project on the back burner. Within a few 
years. Hitler started World War II. and the now-graduated engineer found 
himself drafted and sent to the Army ’s top-secret Pccncmunde research base 
in the Baltic. Wernher von Braun assembled a team there to build the first 
large ballistic missile, the A-4. later renamed by the German hierarchy as the 
infamous V-2. Assigned to the guidance system development section, 

Hoel/er discovered that there were severe problems in controlling the big 
rocket. The liquid propellants moved around in their tanks, the rocket had to 
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pilch over at a specific instant or it would not hit its aiming point, wind gusts 
affected it. and so on. Earlier rocket programs faced these issues, but not on 
the scale that the A-4 demanded. 

Von Braun's team decided to use graphite vanes mounted in the exhaust 
of the engine to turn the rocket much as a rudder in the water turns a speed- 
ing boat. These vanes were coupled to tabs on the tips of the stabilizing fins, 
which increased the corrective forces while traveling through the atmo- 
sphere. The control system had to keep the rocket balanced, maneuver it at 
the correct points, and keep it on course. 

In the early versions of the A-4. a directional radio beam similar to the 
British "Oboe'' and German "Egon’’ blind bombing systems indicated the 
Bight path the rocket needed to take. The rocket followed the invisible radio 
beam pointed at the target. The guidance and control group devised a variety 
of simulators to make certain that this complex system worked. These ranged 
from the expensive and full-scale to laboratory versions. An example of the 
former is the structure that supported a full-size A-4 suspended on a gimbal. 
The rocket actually ran its engine and the control system tried to keep it 
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righted. This sort of test depended on a lot of components working correctly 
at one time. 

The problems mounted when the live-fire tests ended in catastrophic 
engine failure before the control system could be tested, or if the control 
system itself mined the test in some way. The engineers on the project thus 
sought a way of isolating the work on the control system. Initially they used a 
mechanical simulator, which turned out to be unsatisfactory. 4 ' Hocl/er 
designed an electronic version that was much more effective. Many of the 
components in this simulator modeled those that the A-4 needed for lateral 
guidance and attitude control. Hoelzcr combined the beam rider circuitry 
with the attitude control system to form what he called the Mischgerat , or 
“Mixing Computer.” This was the first fully electronic active control system 
and was the basis for the use of analog computers in aircraft flight control 
systems as advanced as those in the F- 16 and F- 1 17A. The A-4 contained the 
essential components of a fly-by-wire system: sensors, a central computer, 
and navigation information. Operation Paperclip transferred this technology 
directly to the United States after the war. Soon thereafter, the von Braun 
team led the development of a series of rockets of ever-increasing size. 

These eventually resulted in the capability to orbit artificial satellites as well 
as fly to the moon. 

The Avro CF-10S Arrow 

The use of fly-by-wire technology in the A-4 exemplifies the technology 
as a solution to a control problem, a solution put in place to control existing 
hardware. In the 1950s. Avro Canada also applied it as a solution to aircraft 
control. Due to the vast territory of Northern Canada and the threat of Soviet 
nuclear bombers coming over the Pole, the Canadian Air Force issued a 
request for proposal for a Mach-2-plus interceptor that could execute a 2g 
turn at 50.000 feet without losing altitude. In addition, it had to deliver a 
large payload of air-to-air missiles under ground control. These specifications 
exceeded the capabilities of any fighter, in service or in planning, worldwide. 

Avro proposed a large aircraft (about as long and tall as the Lancaster 
bombers it had built in World War II) with a high-mounted delta wing, coke- 
bottle '‘area-rule" fuselage, and a skyscraper vertical tail. The initial intention 
was to use a mechanical control system and couple the remote automatic 
interception interface to the autopilot. 40 However, the designers discovered a 
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A dtgilal artist's rendllon of cne ol the CF-105s in light. (Courtesy ot Paul McDonel). 
yaw instability that would have required a much larger vertical stabilizer. 
Their solution was to adopt a dual-channel fly-by-wire system made of 
analog circuits. At first, the system had no '“feel.” since control surface 
motion was a result of stick motion generating an electrical signal, not 
moving a cable. Eventually Avro had to install springs to provide imitation 
forces for the pilots. This aircraft is obscure because it had its official rollout 
on 4 October 1957. the same day the Soviets launched the first Sputnik. 
Nevertheless, when it had its first flight on 25 March 1958. fly-by-wire had 
come to high-performance aircraft, if only to provide a yaw damper extended 
to three-axis flight control. 

The Canadian government canceled the CF-105 in 1959. The beginning 
of the next decade marked a shift in the use of fly-by-wire. Rather than 
focusing on fly-by-wire as a solution to immediate problems, aeronautical 
designers began exploiting the technology for its own advantages.* 1 

The Apollo I.unar Module 

The epitome of active control, prior to fly-by-wire in aircraft, was the 
Lunar Module of the Apollo spacecraft. Even though the A4 had an active 
control system, it also had passive assistance during the most difficult parts 
of its trajectory: early ascent and final descent. This assistance came from the 
large fins attached to the base of the rocket. As the A4 climbed through the 
lower atmosphere and passed the "max-q" |dynamic pressure) transonic 
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region il gained significant stability simply because the fins were moving 
through air. 

Even though it is now quite practicable to design a rocket control system 
that docs not depend on aerodynamic assistance, relatively few are built that 
way. Generally, the fins are used, except in eases where they arc more trouble 
than they are worth, such as in silo-launchcd intercontinental ballistic mis- 
siles. In the ease of missiles intended for atmospheric flight, such as air-to- 
air weapons, the fins arc one of the effectors of the control system. However, 
the Lunar Module could not depend on aerodynamic assistance in any form. 

It was the first piloted vehicle designed to operate throughout its entire flight 
envelope in an airless environment. As such, it was necessary to provide the 
craft with all the components later needed for fly-by-wire aircraft. 

Prior to the Space Shuttle, and even now on all the Russian piloted space 
flights, the crews ride in what arc essentially ballistic reentry bodies with 
little lift. During ascent, the crew faces forward, toward the acrodynamically 
tapered nose. During descent, they face to the rear of the direction of flight, 
as the blunt end of the spacecraft is used to slow it during entry into the 
atmosphere. The heat generated by friction with the air is dissipated by using 
materials that bum off the spacecraft, which means that this type of capsule is 
reusable only with extensive repair. No United States spacecraft of this type 
has ever been reused. 


The early spacecraft carrying human beings shared one common charac- 
teristic: they lacked any w ings or fins. This was entirely due to the desire for 
simplicity. At the same time McDonnell-Douglas was building the Mercury 
and Gemini capsule-type spacecraft for NASA. Boeing was working on the 
X-20 Dyna-Soar project for the Air Force. The X-20 was to be a piloted stub- 
winged craft mounted atop a Titan booster. Had the project continued, the 
X-20 would have had the distinction of being the first fly-by-wire 
acrospaeceraft. However, the project was canceled, leas ing the field to the 
initially simpler Mercury and Gemini, and the eventually more complex 
Apollo. 

The control system in the Mercury space capsule consisted solely of an 
attitude controller designed to work in free fall. The guidance system on the 
booster rocket controlled the ascent portion of a Mercury suborbital or orbital 
mission. In the ease of the Redstone, it was an electromechanical guidance 
system using technology not much improved from that of the A-4. The Atlas 
booster used a ground-based computer to calculate steering signals based on 
inputs from radar stations. 

Once separated from the booster, the Mercury spacecraft was in a 
ballistic path existing in a relative vacuum. Small jets could be used to 
induce pitch, mil. and yaw movement. Similar reaction-control jets had 
already flown on the North American X-15 winged acrospaeceraft to control 
it when it rose far enough above the atmosphere that its conventional control 
surfaces were not much use. In Mercury, these jets were connected to a fly- 



by-wire system with a mechanical backup. 

The logical design consisted simply of a control signal that transmitted 
"on'off ' commands for the firing of the jets. The attitude of the spacecraft 
could be changed by the pilot's moving a hand controller, with the direction 
of the controller’s movement indicating pitch, roll, or yaw to the control 
system. The control system then sent the appropriate signals to fire the 
correct set of jets to achieve the desired effect. 

The Mercury spacecraft could only perform one maneuver that was not 
strictly attitude control: entry into the atmosphere. For that, the pilot used the 
control system to point the blunt end of the spacecraft, with its rocket pack, 
in the direction of (light. When the rockets on the pack were fired, a reduc- 
tion of velocity occurred that was sufficient to drop the spacecraft out of 
orbit. The attitude control system then kept the spacecraft's heat shield 
aimed along the axis of descent. All of this could be done automatically, but 
the early astronauts, not much removed from their test-pilot days, often 
insisted on "flying" the spacecraft in even the limited ways available. 

By the time the Lunar Module was ready to fly. the pilot was fully 
integrated into the spacecraft. Surveyor spacecraft void of human passengers 
made successful automatic soft landings on the moon several times in the 
mid-19(tf>s. However, the Lunar Module was a much larger and heavier craft, 
and had the additional restriction of carrying two humans considerably less 
sturdy than the instrumentation on Surveyor. When Apollo 9 flew into earth 
orbit in early 1969. the Lunar Module and Command Module practiced for 
the first time the dance they would do before the otherworldly audience of 
the Moon's craters. 

The flight control mechanism on the Lunar Module was the Primary 
Guidance. Navigation, and Control System, which was referred to as 
PGNCS. pronounced '"pings." 42 MIT’s Instrumentation Laboratory (later 
Charles Stark Draper Laboratory) developed the system for NASA. Engi- 
neers had gained considerable experience by developing the guidance and 
control for the Polaris submarine-launched ballistic missile and the backup 
guidance system for the intercontinental Atlas during the late 1950s. They 
also used some Air Force independent research and development funding to 
plan a reconnaissance mission to Mars with the objective of taking one 
photograph and returning it to Earth. They worked on the Mars probe in 
1958. and thinking about the interplanetary navigation problem served the 
team well when they eventually received the NASA contract for Apollo’s 
guidance and control three years later. They had proposed having an on- 
board digital computer in the probe to make maneuver calculations, and this 
experience resulted in several concepts eventually incorporated into the 
PGNCS. 

The Apollo guidance and navigation system had all the elements of later 

"Into E.Tomayko. tY-ipum wSpaulMKi (Wnhlngun DC: NASA CR-182505. March l*iK>. 
Chaplet Three. 


IS 




systems used in aircraft, but its operational scenarios differed in one major 
respect from most atmospheric vehicles: it spent long periods in coasting 
llight. Once the spacecraft entered an orbit around the Earth, the Moon, or in 
the highly elongated elliptical trajectory between the two. it needed no 
further assistance from the control system until just before the next powered 
maneuver. On the lander. PNGCS functioned only in the descent to the moon 
and ascent into lunar orbit to rendezvous with the waiting Command Module. 
This means that there was a requirement to realign the sensors prior to any 
engine firing. The crew accomplished this task as part of the pre-maneuver 
preparations. 

The PNGCS used inertial measurement units in three axes to sense 
accelerations. Therefore, the units had to have one axis lined up with the 
centerline of the thrust vector from the engines. Once the crew accomplished 
this, the inertial measurement units would generate analog signals propor- 
tional to the accelerations sensed as the engines fired. Converted to digital 
data words, the information entered the flight computer software as param- 
eters for the powered flight-control routines. The software compared the 
changes in velocity in all axes to the prc-calculatcd target velocities; it then 
issued commands to main engines and altitude-control thrusters. 

When the Command Module executed a maneuver, the pilots could often 
assume a "hands-off ' position, given that the most frequent reason to use the 
main engine was various orbil changes. However, the PGNCS on the Lunar 
Module had to allow for frequent pilot input, especially during descent to the 
surface. This is why the PGNCS software on the lander was in some ways 
more sophisticated than its brother in the Command Module. 

The first lunar landing had all the drama of any science fiction film, yet 
most of what really happened was unknown to the world at large at the time. 
As Neil Armstrong ami Buzz Aldnn descended to the surface, the computer 
received so many requests for interrupts from the sensors that it began to get 
behind in its critical processing. This situation resulted in restarts that caused 
both crew and ground controllers considerable concern, so much so that there 
nearly was an abort. With scant seconds of fuel remaining. Armstrong had to 
fly the Eagle away from a boulder field that was in the primary target area. In 
overcoming these obstacles, the fly-by-wire PGNCS proved its capability. 

The difficulty and romance of lunar flight inspired many projects across 
NASA centers. The Flight Research Center was mi exception. Its indigenous 
Lunar Landing Research Vehicle— a project to explore techniques for simu- 
lating lunar landings — involved people and ideas that would carry over into 
the fly-by-wire program. 
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Chapter Two: The Origins of NASA’s Involvement in 
Fly-by-Wire Research 


The idea of lunar flight even caught the imagination of engineers outside 
of NASA's space centers. At the Flight Research Center at Edwards Air Force 
Base, a small group designed and built the Lunar Landing Research Vehicle, 
or LLRV. in conjunction w ith Bell Aircraft. This project had no direct organi- 
zational connection to Apollo. Its objective was to explore solutions to flying 
in the environment near the lunar surface and to simulating that environ- 
ment. 1 Work began in 1961. with some hope of influencing the final Lunar 
Module design. 





The Lixtar Landing Research Vehicle (lying al ll>e Flight Research Center in 1967. (NASA photo 
ECN-1606). 

The Moon has one-sixth the Earth's gravity, so the major problem in 
building the LLRV was negating the remaining live-sixths. The solution was 
a vertically mounted jet engine that had enough thrust to support the 
vehicle's weight in such a way as to give the pilot the feeling he was operat- 
ing in lunar gravity. The LLRV was not aerodynamic. It used reaction jets for 
maneuvering. The Flight Research Center chose a type of fly-by-wire system 
to control it. 

By the late 1960s. Flight Research Center engineers had several ex- 
amples of NASA's use of fly-by-wire: the LLRV. the piloted spacecraft, the 
X-15 reaction control system, as well as the lifting bodies. Also, the X-15 
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was winding down, the LLRV was over, and it was time to move on to 
different work. The Flight Research Center aims to serve the aviation com- 
munity by experimenting with new technologies, so the engineers started 
brainstorming projects that would have high impact. A group led by Melvin 
E. Burke and including Calvin R. Jarvis. Dwain A. Dccts. and Kenneth J. 
S/.alai. thought that a project to explore the capabilities of fly-by- wire in 
aircraft would have the most leveraged They reasoned that commercial 
airplane manufacturers would be hesitant to adopt the technology without 
extensive evidence that it worked. Also, they wanted to explore the concept 
of active control and its capabilities to revolutionize airplane design. They 
felt that the time was nght to do this work, as the enabling technologies had 
reached a stage where they could be used to build active control systems. 
Burke, a hardw arc specialist, knew that what such a project needed was 
highly reliable sensor, computer, and actuator components. By the end of the 
l%Os. all of these had evolved enough to be useful in a fly-by-wire airplane. 

Maturation of the Enabling Technologies 

In an active control system centered on a computer, sensors provide input 
and the actuators execute the output commands. This is a feedback system in 
which control-surface deflections caused by the actuators change the state of 
the sensors, which affects the output from the computer, and so on. Such 
systems had already been used in autopilots and rocket guidance as well as in 
the LLRV. The sophistication of these sensor and feedback systems rapidly 
increased in the 1940s and 1950s as research into Hying qualities led to the 
development of “variable-stability" aircraft. The Cornell Aeronautical 
Laboratory built a series of these special planes, which consisted of existing 
airframes with equipment added to change their handling characteristics. 
There are two types of such variable-stability systems: "response feedback" 
and "model following." In the former, the scheme is set up to sense the 
aircraft response to a particular pilot input and then feed that to the control 
system. In the latter, onboard computers "force” the aircraft to respond in a 
way identical to the model of the target aircraft." 

One of the most long-lived and famous of the variable-stability test 
aircraft was a T-33 that had the long nose of an F-94 attached to it in 1954 to 
hold the control system.* This aircraft evolved over a 35-year period from 
relatively primitive analog controls to advanced digital systems. Besides 
flying-qualities research, the modified T-33 was used to mimic other aircraft 
to work out control problems. One of its last projects was simulating the 
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Swedish Saab JAS-39 Gripen fighter aircraft. Its fly-by-wire flight control 
system was the suspected cause of a crash, and the variable stability aircraft 
helped verify changes in the software. This technology has been adapted to 
other more permanent uses such as the Gulfstrcam jets using Sperry flight- 
control equipment modified as landing trainers for the Space Shuttle orbitcr. 
One place in the two-pilot cockpit closely resembles the Shuttle’s cockpit. 
Aside from routine landing training at the Johnson Space Center and the 
Dryden Flight Research Center, an aircraft is often ferried to potential Shuttle 
landing sites during missions. In ease winds arc questionable, an experienced 
astronaut can fly landing approaches in the Gulfstrcam to determine how the 
Shuttle itself would handle. 

Aside from the variable-stability aircraft’s valuable contributions to flight 
control capability, other more limited flight-test programs helped contribute 
to the maturity of the enabling technologies. In the late 1960s. a B-52 flew 
with an analog-based flight-control system activated from the left pilot scat. 

It explored the potential for "structural mode control." such as overcoming 
the loss of a major portion of the tail or wing.' Other operational aircraft, 
such as the F- 111 and Concorde, had stability augmentation. The electrical 
component of fly-by-wire systems showed up in the French Mirage fighter 
series as early as 1963* 

So parts were nearly in place. It only remained for NASA to assemble 
them in an existing aircraft to prove the principle and lay the groundwork for 
operational use of the fly-by-wire concept. This was easier said than done, 
however, since the three enabling technologies came from such different 
roots and were not necessarily compatible. 

Sensors 

Sensors arc carried on all aircraft. Depending on the sophistication of the 
autopilot and navigation system, there may be many different types of 
sensors. As an example, one of the simplest and most prevalent is the pitot- 
static system, which supplies information to the pilot and flight-control 
system about airspeed, vertical speed, and altitude. A relatively small hollow 
tube, the pitot projects from the wing or fuselage of an aircraft in such a way 
that there is an unobstructed flow of air into it. The pressure of this ram air is 
compared w ith the pressure of stable outside air gathered through a port 
mounted away from turbulence. Through comparison of the two pressures, 
indicated airspeed can be calculated. 

In the ease of the pitot-static system, the "sensors” are completely 
passive: the pitot tube and static port essentially sample the air directly. Also, 
since the static air sample is taken without any correction or correlation to the 
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movement of the air outside the aircraft, the airspeed indicated on a gauge is 
not the ground speed. This is because it has no way of allow ing for the 
effects of wind. An aircraft with a direct 20 knot-per-hour tailwind would 
actually be moving relative to the ground at the indicated airspeed plus 20 
knots. This means that the pilot is responsible for calculating the effects of 
w ind using weather data and computers that contain information about the 
overall impact of wind from all directions. 

Gyroscopic instruments arc more complex. A gyroscope tends to resist 
forces applied to it once it is spinning. Thus, an instrument such as an attitude 
indicator can use the position of a gyroscope to correctly show changes in the 
angle of the wings and nose of an aircraft relative to the horizon. In this ease, 
the sensor is the gyroscope itself coupled with some reference point. In 
simple aircraft the pilot is responsible for monitoring the attitude indicator to 
keep the aircraft straight and level or to use it as a reference in turns. In 
visual flight conditions, the attitude indicator is largely unnecessary since the 
pilot can use the actual horizon for reference. However, in instrument-based 
Hying, the indicator is crucial to the pilot’s ability to maintain orientation. 

Gyroscopic sensors can also be used to measure angular velocities. These 
"rate gyros” arc the basis for stability augmentation systems and arc impor- 
tant components in fly-by-wire controllers. In the late 1940s. Boeing pro- 
duced the first swepl-wing tiirtxijct-powcred bomber, the XB-47 Stratojet. 
During (light tests an excessive yaw motion occurred at low speed and low 
altitude, with the problem worsening as wing loading increased (either from 
extra weight or maneuvering). ? The solution was the addition of a rate gyro 
mounted in the yaw axis. The gyro generated a signal voltage proportional to 
the yaw rate, and that voltage value positioned a push-pull tube to damp yaw 
motion: this constituted a simple, one-axis stability augmentor.' 

This technology rapidly proliferated: the British used yaw dampers on 
the Meteor jet fighter and a pitch damper on a six-engine flying boat. The 
Northrop YB-49 Hying wing also had some stability augmentation added 
after achieving Bight status.'' Note that all of these stability augmentors came 
into use as a reaction to problems in actual flight test. They provided valuable 
experience in the use of sensors and feedback. 

Burke used another type of sensor for the fly-by-wire project: an inertial 
measurement unit.'" Such devices had been developed in the 1940s. They 
measure accelerations in each axis of motion. This acceleration data is used 
in an inertial navigation system to calculate velocity and position without any 
other sensor input. This is handy in a vacuum. Since good inertial measure- 
ment units were common in the space program, they could readily provide 
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data for ihc computer, the next device in the control chain. 

The Role of the Computer 

The central component of all fly-by-wire systems is the flight computer. 
The computer uses control laws specific to an aircraft to calculate the com- 
mands necessary to maintain stability and implement pilot desires. Control 
laws arc the equations of motion that have to be solved to actively control an 
unstable aircraft. The values for these equations arc specific to each aircraft 
design. That is why control laws embodied in electronic analog circuits make 
those circuits unusable in any other aircraft. There arc two types of comput- 
ers used in fly-by-wire systems: analog and digital. Each type has advantages 
and disadvantages, and there was considerable debate among the N'ASA 
engineers over which to use. 11 

Analog computer, exist in a wide variety of forms. In fact, long after the 
advent of digital computers, there were still many more analog computers in 
use than the digital ones so familiar today. The log-scale slide rule, once the 
dominant personal computing device, is an analog computer. It works by 
creating a mechanical analogy between the positions of numbers on its 
various scales and the products, quotients, squares, square roots, cube roots, 
etc., that it is used to calculate. Another type of mechanical analog computer 
was the differential analyzer, which was in scientific use from the early 
1930s through the early 1950s (and was one of the lesser known "stars 1 ' of 
the film When Worlds Collide). The "DA." as it was called, had cams of 
various shapes to model the terms of equations. The analyzer filled a good- 
sized room and had to be operated by hand. 

Such mechanical analog computers arc not as practical flight-control 
devices as their electronic brethren. The German A-4 [V-2) system used such 
an electronic analog computer. It modeled the differential equations of the 
control laws and conveniently accepted voltage values as input and generated 
them as output. These voltages could then be amplified as commands to the 
actuators of the control system. Thus, by the early 1940s it was possible to 
use an analog computer in flight control. For nearly forty years thereafter, 
such devices formed a core enabling technology for fly-by-wire. 

The fact that the control laws arc hard-wired into an analog computer is 
both an advantage and a disadvantage. The advantage is that it is difficult or 
impossible to corrupt an analog computer through power transients, software 
viruses, or other weaknesses experienced by digital computers. The disad- 
vantage is that to “re-program” an analog computer, one must physically 
rearrange the circuits into a new structure that models the modified control 
laws. Furthermore, analog circuits arc subject to signal drift in their re- 
sponses. and this must be compensated, usually by voting of output front 
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multiple circuits. 1 ' Higher temperatures also affect analog computers because 
information is in the form of amplitudes, and temperature effects modulate 
the amplitude. Nevertheless, analog computers were used in the Canadian 
CF- 105 and the first U.S. Air Force fly-by-wire tests. Burke and Jarvis were 
familiar with them from the LLRV program. 

In the late 1950s. when the concept of fly-by-wire first came under 
serious research scrutiny, the image generated by "computer" was of a multi- 
ton monster voraciously consuming space and power— hardly an attractive 
alternative for aircraft control-system designers obsessed with the limitations 
of size, power, and weight in aerodynamics. Thus researchers only consid- 
ered digital circuits in limited areas. A 1961 study at the U.S. Air Force Flight 
Dynamics Laboratory simply replaced analog amplifiers with digital differ- 
ential analyzers. 1 ' 

Substituting circuits forced the engineers to face the key difference 
between analog and digital computation. Analog devices depend on a con- 
tinuous stream of data signals. Digital circuits, by their very nature, need data 
to be transformed into a stream of bits. The problem is that the signal streams 
in a complex real-time system might be too dense and rapid for the analog- 
to-digital converters to deliver all the sensor data to the computer. 1 * This 
means that the data must in effect be sampled, rather than used in totality. 

The difficulty is in the accurate processing of sampled data in order to make 
it as useful as a complete data set. It was not until 1965 that the mathematical 
basis of digital control became widely available due to published work on 
sampling theory. 1 ' Note that aircraft systems were not the only beneficiaries 
of this foundation. Digital control in manufacturing, automobiles, and 
medical instrumentation has similar problems and has benefited from this 
information. 

Another aspect of digital computers that needed to be improved before 
they could be used in aircraft was their size. Prosper Eckert ami John 
Nlauchly had a lot to do with the development of the world’s first general- 
purpose electronic computer, the ENIAC. at the University of Pennsylvania 
during World War II. It filled a very large room and requited significant 
power and air conditioning to operate, primarily since it used vacuum tube 
technology. After the war. Eckert and Mauchly started their own computer 
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company and built a computer for Northrop that was eventually intended to 
fly in an aircraft. However, as with a graphite-pile nuclear reactor carried in a 
B-36 in early tests of atomic power for aircraft, no one thought of their 
computer as a practical device. 

The transistor improved the situation tremendously, and a discrete- 
circuit. transistorized computer built by IBM flew in the Gemini piloted 
spacecraft in the mid-1960s. It was the development of the integrated circuit 
that truly made embedded computers in aircraft practical. Early in the 1960s. 
the Apollo spacecraft development and the Minutcman ICBM (intercontinen- 
tal ballistic missile) program consumed nearly all U.S. production of inte- 
grated circuits for their respective guidance systems. Still, these computers 
had their logic represented by collections of low-density chips, some, such as 
the Apollo computer, with as few as four gates. Each gate represented one 
Boolean function. Current integrated circuits can have millions of gates. 

The improvements in digital computer hardware made possible equally 
important improvements in the capability of the software that embodies the 
control laws of the aircraft. Whereas with an analog computer the “software" 
is essentially hardwired into the machine, a digital computer can be adapted 
to many different uses by changing its programming. A limitation on soft- 
ware for real-time systems in aerospacccraft is the size of a computer word. 

It not only affects the scale at which the computer can do computations: it 
affects the flexibility of its instruction set and the application software built 
for it. Engineers programmed early digital systems exclusively in low-level 
machine languages that arc very difficult to inspect and understand and thus 
prone to human error. Early recognition of the inherently complex nature of 
these machine-based languages inspired the development of machine- 
independent languages such as FORTRAN, which express mathematical 
formulae in terms more recognizable by the average engineer. However, the 
use of such high-level languages requires special translation software such as 
interpreters and compilers that recast the language statements into machine 
code. 

Even though these languages reflected a significant engineering improve- 
ment. they were not readily adaptable to the embedded computer systems 
demanded by fly-by-wire. They lacked statements to support functions such 
as scheduling of processes. Also, real-time systems have strict performance 
constraints, and engineering managers thought compiler-generated machine 
code was too inefficient to meet these requirements. 14 

Effectors and Actuators 

The last enabling technology for fly-by-wire flight control consists of the 
actuators that move the control surfaces. In the mechanically based flight- 
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control systems, the control surfaces move under direct-cable positioning. 
This is replaced by electrical connections to actuators in fly-by-wire systems. 
In fact, the original meaning of ‘'fly-by-wire'' is limited to this technology 
alone. 

Gavin Jenncy. one of the pioneers of the technology, working at Wright- 
Pattcrson Air Force Base and founder of the aptly named Dynamic Controls. 
Inc., says that. "When we were developing fly-by-wire, the purpose was to 
provide safe and reliable electrical control between the pilot and the flight 
control surfaces as a replacement for the mechanical connection.” 1 ' Such 
connections did not need cither computers or sensors, but rather simple 
physical force to electrical force converters at one end. and electrically 
operated hydraulics at the other. Such systems could be made triply or 
quadruply redundant and still obtain weight savings along with reliability 
increases over even dual hydromechanical systems. It would have been 
nearly impossible to achieve practical fly-by-wire without the electrical 
actuators and their associated equipment. 

This is what had been achieved in sensor, computer, and actuator tech- 
nology when Burke’s group was considering fly-by-wire for airplanes. The 
engineers felt that these technologies had reached a point where they would 
be practical to use. However, it would be necessary to make hard choices 
before even trying to sell the program to Center Director Paul Biklc. He has 
been characterized as “sensitive but not sympathetic." He would listen to an 
idea, but as soon as it failed to catch his interest, he would simply walk 
away." They had to have a solid plan before meeting with him. The most 
difficult choice was whether to use a digital or an analog computer. Most 
other decisions depended on that one. 

Analog versus Digital 

There arc two ways to send numbers on electrical wires: continuously, or 
in ones and zeroes. Numbers are transmitted in electronic analog circuits as 
continuous current at varying voltage levels proportional to the values being 
transmitted. Volts arc a measure of pressure, so the bigger the value, the 
larger the voltage. Digital signals are sent as streams of bits— binary digits— 
which can be cither ones or zeroes. A specific bit length represents a word of 
information. Once in the computer, the data is manipulated with the control 
laws for the airplane. In an analog computer, the equations are represented by 
circuits that implement the mathematics. In a digital computer, the control 
laws arc in software. This means that analog computers arc effectively a 
single-airplane system: they cannot be moved from one type of aircraft to 
another without extensive physical changes. In a flight-test program, charac- 
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Icri/cd by continuous tweaking of components, this could potentially be a 
problem. In a two-phase program like the lly-by-wirc project, where an 
aircraft change is possible between phases, analog computers are even more 
awkward. 

Digital computers are more flexible due to software. The phrase "general 
purpose computer.'' which is only applied to digital machines, implies their 
ability to adapt through different software programs. However, digital 
computers have advantages in addition to their programmability. By proper 
scaling of the data represented in digital words, such computer, can be made 
to be more accurate than their analog counterparts. They also can compensate 
for drift in analog subcomponents. An attraction for the engineers at the 
Flight Research Center was that with a digital system, they could include 
some logic in the control laws, making them more robust . 1 ' 1 

Analysis of the choice between analog and digital computers shows that 
at the time any comparison made based on considerations of pure size and 
complexity docs not show much difference. For simple systems like short- 
lived missiles and non-combat aircraft, analog computers arc best in most 
instances. Conversely, most complex systems have long-living applications 
that benefit from software changes. However, as one flight-control engineer 
said. "Just where this crossover point lies is difficult to judge.'' Therefore, the 
final decision had some political aspects. 



This B-47 was modilied by the US. Ar Force as a llyby-tvite testbed using analog computers. 
(U S. Air Force photo] . 


The team at the Flight Research Center initially wanted to go with analog 
computers.^' It had experience with them from the LLRV project, plus there 
was the U.S. Air Force’s fly-by-wire test program as a source of expert - 
V D.A. Dee i\ mlKJ. Su.il.ii. "Design and FligM Experience with a Digital Fly-By. Wire Cixurol System 
tiling Apollo Guidance System Hardwire on F t Aircraft." PnuvrJilt*! ofthi AIAA CuA&Uk r and 
Couirol Crnfae nr. Stanlced. CA. IAIAA Paper No. T'-SSU. 1972. p. 1 

* Law Wallace, inters lew with Cal Jarvis and Ken Sralai. Dryden Flight Research Center. 30 Aug. 1995. 



encc/ 1 However, the Air Force had been Hying a modified B-47 with lly-by- 
wirc initially in only the pitch axis/' Furthermore, it was about to embark on 
the Survivablc Flight Control System project with an F-4 aircraft, which 
would have a complete three-axis control system based on analog computers. 
As the group at the Flight Research Center considered this, it decided not to 
compete with the Air Force and to take the leap into the digital world.'' 

It is not clear that the engineers knew what they were getting into by 
starting to deal with software. Software’s flexibility is a bane as well as an 
advantage. It is too easy to change and very difficult to change correctly: fifty 
percent of all software modifications, including defect repairs, result in new 
defects. By 1972, Dw ain Deets and Kenneth S/«ilai came to think of a digital 
computer and its software as a patchboard in which any two points could be 
inadvertently, and invisibly, connected. In an analog system an incorrect 
connection was more easily visible.' 1 Nevertheless, they pressed on w ith 
digital technology. The problem then became getting a digital computer 
suitable for Bight control. There were no widely available computers at the 
time with the size, power requirements, weight, reliability, and performance 
needed for flight. There were the computers used in piloted spacecraft, 
however. The first proposal was to use three Gemini spacecraft computers/' 

Nothing had been settled before Mel Burke and Cal Jarvis went to 
Washington to find the money for the program. Director Bikle. a sailplane 
pilot, had the vision to see the aeronautical implications of fly-by-wire and 
supported the proposal.* However, the project had the potential to be a 
tough sell further up the NASA funding chain. A new project at the Flight 
Research Center was encouraged to have industry interest in the results. But 
commercial manufacturers were essentially ignorant of digital fly-by-wire. 
Moreover, even if knowledgeable, they had to consider the three factors that 
were essential to any control system choice for commercial aircraft: safety, 
performance, and cost of ownership/ So the selling point for the project 

; lame* E. Tomayko. "Ulmd Faith: The United States Air tin* and the Development of Fly-By- Wire 
Tedakdogy,” TnAnialogv and the Air Far re: A Btiroipnittr lUtruww, lacob Ncuield. George M. 
Walton. and Duvid Chenoweth. edt. (Wathington DC: The United State* Air Force. 1997k pp 16V 185. 

Neuter the Air Force nor NASA't engineer* hod knowledge at the Canadian analog flv-by - ere Ct- 
105. even though it ha) fin* flown 1 2 year* earlier The Air Force hod an exchange officer from Can ala 
necking on fly-by -wire at Wnght-Pallertco Air Force Have, and even he affluently <IkI not realize tha the 
Arrow hoi been fly-by-wire. One explanation for it* ohtcuiily nai that the i>eo labor government in 
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surfaced in ihc demonstration that fly-by-wire, especially digital fly-by-wire, 
would have sufficient impact to get manufacturers on board. 

At NASA Headquarters 

Burke and Jarvis had an advantage when they gave their sides pitch in 
Washington. They had to start at the Office of Advanced Research and 
Technology, and at that time Neil Armstrong was a Deputy Associate Admin- 
istrator for Aeronautics. Burke knew Armstrong from the X-15 project. 2 * 

They also had to deal with Peter R. Kur/hals and Frank J. Sullivan, the 
successive directors of electronic guidance and control research, but 
Armstrong had an immediate interest that made him their key ally.** He 
wanted to see more technology transfer from the Apollo program. When told 
of the analog versus digital debate and the difficulty of finding a reliable 
airborne computer, he said to Burke and Jarvis. ”1 just went to the moon with 
one."'' 1 In fact, the Apollo computer was one of the most reliable ever built 
(see Chapter Three). With the Apollo program shortened, there were plenty 
of machines available. Armstrong suggested contacting the Draper Labora- 
tory to explore the feasibility of using modified Apollo hardware and soft- 
ware on the F-8. Burke and Jarvis briefed Dr. George Cherry, head of the 
Guidance and Control Division at Draper, on the project objectives and he 
was extremely supportive, beginning a strong relationship between the Flight 
Research Center and the Laboratory that facilitated the transfer of much 
space technology to the world of aeronautics." One of the first positive 
results was the use of Apollo hardware for the first phase of the project. The 
F-8 team would inherit a solid software development infrastructure and 
process that would have long-lasting impact on how the Center would build 
software in the future. 

When Burke and Jarvis returned to the Center, an initial budget was in 
the works. The project was to start in early 1971.* 2 For the first year, the 
allotment was one million dollars, a small amount by space flight stan- 
dards.” The entire project, over a decade long, would cost only $12 million. 
The major task immediately confronting the engineer, was acquiring an 
inexpensive airplane that could be modif ied to fly-by-wire. 
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Finding the Testbed Airplane 



•' Knci inlerview. 9 Jan. I9». 

“ Burke interview. I? Feb 1998. 


Even as far back as 1971 . a million dollars would mil go far toward 
buying an aircraft, so Burke looked for cheaper, preferably free, alternatives. 
NASA flew a mini-squadron of Lockheed F- 1 04 Starfighters. Adapting one 
of those seemed a quick solution. However, discussions w ith the test pilots 
and mechanics quickly canceled that. The Center, obviously not using an 
airplane designed for fly-by-wire, would have to modify the plane for digital 
control. Some of the more exotic modifications like canards, for instance, 
could be placed in front of the wing, and the horizontal stabilizer could be 
removed. The result would be an unstable airplane that would better demon- 
strate the viability of the concept. The pilots and mechanics pointed out that 
the most likely location for canards on an F- 104 is on opposite sides of the 
nose. Unfortunately, the F- 104 had engine air intakes on cither side of the 
fuselage behind the cockpit. This meant that when the canard surfaces 
moved, they would disrupt airflow to the engine, with a flamcout resulting." 

Burke finally contacted Admiral Forrest S. Petersen, who had flown the 
X-15. and asked for help. Petersen plucked four Chance Vought F-8 Crusad- 
ers. the Navy's first supersonic fighter, from their destination at the boneyard 
and sent them to the Flight Research Center instead.'-' Ken Szalai had a 
model of an F-8 modified to show the proposed changes that would make it 


A redundant electrical actuator of Ihe type that needed to be developed tor the F-8. (NASA pfioto 
EC7 1-2942). 





dependent on fly-by- wire. The horizontal stabilizers were cut off and moved 
in front of the wing (the F-8's single centerline air scoop was not affected), 
and the twin ventral fins at the tail were replaced by a single forward- 
mounted fin. Unfortunately, it quickly became apparent that the F-8's stable 
configuration, plus sensor additions, computers, and new actuators, would be 
an engineering and fiscal challenge sufficient to consume all available 
resources. The futuristic-looking F-8 model resided for over 25 years in 
Szalai's office, its real-life cousin never built. (Remarkably, the planform 
almost exactly matches that of the X-3 1 !> 

The Split into Phases 

As 1970 wound down, planning continued. When Burke left the project 
for a job at NASA Headquarters. Cal Jarvis took over as project manager. 

The decision to stay conservative and not change the F-8’s aerodynamics was 
finalized. A less conservative decision was to remove the entire mechanical 
flight-control system. The Air Force was planning to keep the mechanical 
system as a backup in the F-4 it was modifying with an analog flight-control 
system. In fact, on its first flight, it took off using the mechanical system and 
switched to the electronic while in the air. Jarvis' team thought that would be 
a bad idea. It would not really force the engineers to face the right fly-by- 
wire problems. 10 By using a digital primary system and an analog backup, 
they would be fly-by -wire all the way. The Air Force, for its part, pretty 
much ignored the NASA program. 

It was obvious that a demonstration with a single Apollo computer would 
not be sufficient for the commercial airplane manufacturers. They knew they 
would need redundancy, as in all their other systems, for passenger safely. 
Therefore, the Center engineers decided on a multi-phase program. Phase I 
would have two goals: ensuring that the technology worked, and developing 
the tools for moving forward.' 1 Phase IB would introduce a two-computer 
primary system to begin dealing with redundancy. Finally. Phase II would 
concentrate on gaining knowledge and techniques for highly reliable sys- 
tems. The project was also planned to move fast. The first flight of Phase I 
was set for early in 1972. with the Phase II system definition during the mid- 
1971 to mid-1972 period. The first flight of Phase II was set for the second 
quarter of 1974.** This did not turn out to be the actual schedule, but the 
objectives did not change. This plan in place, the Flight Research Center 
engineers worked on setting and achieving reliability goals alongside their 
software partners at the Charles Stark Draper Laboratory. 

“ Wallace interview n nh S/nl.i ar*J Jam. .*0 Aug. IW5. 
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Chapter Three: The Reliability Challenge and Software 
Development 


"I would like to observe that using all the techniques at our 
disposal . ..1 do not believe we can provide assurance that software 
of any significant complexity achieves failure rates on the order of 
10“ per hour for sustained periods.... Software must generally be 
buttressed by mechanisms depending on quite different technolo- 
gies that prov ide robust forms of diversity. In the case of flight 
control for commercial aircraft, this probably means that stout 
cables should connect the control yoke and rudder |x*dals to the 
control surfaces."— John Rushby. in a report to the U.S. Federal 
Aviation Administration. 1993-' 



This Boertg 777 could not be Itown commercial* without near-urimaginable reliabiily r> its ty- 
by-wre control system. (Photo courtesy ol the Boeing Co.) 


Clearly, the most critical technology in the application of fly-by-wire is a 
means of assuring reliability. When the NASA Flight Research Center team 
made the decision to go digital, it entered a world plagued by finicky hard- 
ware and untrustworthy software. Reliable systems had been built for space- 
craft. but at a cost unlikely to be acceptable to a commercial aircraft manu- 
facturer. and certainly not by Cal Jarvis' minimally-funded project. The F-8 
program took advantage of previous research into reliability, especially 
through the fortuitous choice of an Apollo computer for Phase I and by 
adopting the entire Apollo hardware and software infrastructure. Even though 
the Center took on the difficult roles of system integration and human-rating 
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for flight, the Charles Stark Draper Lab’s development and verification 
process could be inherited outright. This turned into one of the great cost- 
saving decisions of the project team— and not only for the F-8 program: later 
projects involving software benefited as well. None of the engineers so eager 
to use digital systems had extensive software development experience, so 
being able to apply an established process helped tremendously. Draper Lab 
had advanced to the leading edge of reliable hardware and software systems, 
and the engineers there were excited at the prospect of working on the F-8. ; 

The History of Reliability in Computers 

Despite the recent concerns of reliability expert John Rushby. quoted 
above, digital flight-control systems have demonstrated reliable operation for 
35 years, ever since the Gemini program in spacecraft and NASA’s fly-by- 
wire project in aircraft. The aircraft designers using such systems today 
benefit from the early and pervasive concern on the part of computer engi- 
neers about reliability. Early computers, with thousands of fragile vacuum 
tubes, sometimes operated for only seconds or minutes between hardware 
failures. Scientists were willing to put up with abysmal reliability because 
what they accomplished in the few moments of run time far exceeded their 
manual capabilities over many hours. Also, there were no life-critical, real- 
time applications. However, the motivation remained to develop reliability 
technology because it was clear that computers would be around for a long 
time. Scientists realized that lack of reliability would severely hinder usabil- 
ity across a wide range of potential applications. 

It seems unlikely that anyone in the 1940s imagined that future counter- 
parts of their room-sized computers would someday, a quarter-century later, 
fit into one-cubic-foot boxes and be many times more powerful. The chal- 
lenge then, as now. was to create confidence that such systems could work as 
well as mechanical, hydraulic systems over long periods of time. Reliability 
in such systems is in many ways the sum of the reliability of the parts, but 
there is no doubt that some parts arc considered more worrisome than others. 
This is pailicularly true of software. One mantra that came out of the F-8 
program concerned the flexibility of digital computers: analog designs must 
be frozen early in the test program, whereas software could be delivered at 
nearly any time and also reflect changes in the vehicle suggested by earlier 
tests.-* The reliability equation has both hardware and software factors. 
However, changes in software have a high probability of causing a defect, 
making exploitation of its flexibility difficult in life-critical systems. But. 
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early in digital computing history, hardware was more of a problem. 

Von Neumann’s Approach to Reliability and Its Impact on loiter Designs 

While electronic analog computers were small and powerful enough to 
work in flight-control systems as early as 1940. no one seriously considered 
using digital computers for that purpose until the late 1950s. The reason was 
simple: digital computers were still giants. They used vacuum tubes, they had 
large power and refrigeration support systems, and their circuitry was neither 
densely packed nor reliable. As far as aircraft designers were concerned, they 
were cargo. At that time, the chief cause of computer failure was not soft- 
ware defects, as it is today, but hardware faults. A particular logic circuit 
could easily lose a vacuum tube and the resulting loss of a bit would result in 
an error in output. Early computer experts were quite concerned by this, of 
course, because widespread computer use meant that they would eventually 
be operated by non-experts who would be much less likely to detect subtle 
hardware failures. 

John von Neumann, one of the true geniuses of the twentieth century, 
spent much of the last decade of his life thinking about how digital comput- 
ers arc similar to the human brain and about how exploiting the similarities 
could result in more sensible and reliable machine designs. In January 1952. 
he gave five lectures at the California Institute of Technology entitled 
“Probabilistic Logics and the Synthesis of Reliable Organisms from Unreli- 
able Components" in which he suggested a way of increasing the reliability 
of computer systems. 4 He proposed a component called a ‘'majority organ.” 
This would be used to vote the inputs from redundant strings of logic cir- 
cuits. He chose as an example a triple-logic design. Von Neumann showed 
that a positive value e exists for all components that represents their prob- 
ability of failure. Explonng the mathematics, he noted that eventually all 
systems still fail, but increasing the number of input bundles to the majority 
organ allows a designer to fine-tune the desired reliability. 

At first glance, this seemed to ensure that digital computers would never 
find their way into flight-control systems. Objections to redundant digital 
computers centered on size, power, and weight. Triplicating the logic cir- 
cuitry and adding majority organs meant a penalty in all three areas. How- 
ever. within a few years, transistors matured enough to replace vacuum tubes, 
core memories became more reliable and rugged (though still not very 
dense), ami physical miniaturization together with lower power requirements 
all became common. Therefore, interest in using digital computers in control 
systems increased, and von Neumann’s elegant proofs became interesting to 
designers. 


1 John >mi N'cumirm. "PiottabiltMic Logics and lie SymliCMs of KeliihV; Organisms from Unreliable 
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By the mid-1950s, engineers in the Flight Dynamics Laboratory at 
Wright-Patterson Air Force Base had already realized the advantages of fly- 
by-wire.' They began to look at enabling technologies that would make the 
reliability of digital fly-by-wire more equal to mechanical systems. In I960, a 
young engineer named James Morris, who later became one of the primary 
champions of fly-by-wire at Wright-Patterson. led a pro ject to examine the 
state of the art in reliability and make suggestions for control system designs. 
From 1 May I960 to 30 April 1961. a group of General Electric engineers, 
led by J. J. Fleck, did literature searches, conducted interviews in the field, 
and wrote an evaluation of the most prevalent reliability schemes.'' They 
found the von Neumann lectures and did projections showing that identical 
software feeding outputs from individual computeis to majority logic voters 
made failures 300 times less likely in 100 hours of operation. However, 
some of their conclusions turned out to be untrue and others were ignored. 
For instance. Fleck and his colleagues wrote that dual-redundant systems 
would be less powerful than triplc-or-grcater redundancy due to the need for 
a resource-grabbing software monitor and hardware switch. Yet the longest- 
lived spacecraft in operation, the two Voyagers, use three different dual- 
redundant digital computer systems.* Their over- 20- year operational history 
suggests that they are not really impractical. Reck and his associates also 
concluded that redundant components with voters arc more reliable than 
redundant general-purpose computers.” The controller used for the Saturn V' 
booster later used the voter design. However, the continued shrinkage of 
computer hardware has made redundancy of entire processor systems more 
desirable because of their simplicity and interchangeability. 

The majority logic voters were quickly identified as candidates for 
single-point failure that might result in a complete system failure. GE sug- 
gested a single-transistor voter of extreme simplicity. 10 Its engineers felt that 
this type of voter would have reliability equal to that of other hard-wired 
analog circuits. Eventually, this architecture would find its way into the U. S. 
Air Force's F-16. its fin>t operational fly-by-wire aircraft. However, the 
control system used analog computers, with voters. Digital systems rarely 
use this simplistic method of redundancy management. 

Despite these early studies of digital systems, the Air Force at Wright- 
Patterson chose to focus on flight-control systems using analog computers. 

As research on using digital computers for aircraft experienced a hiatus in the 
early 1960s, NASA adopted them for piloted spacecraft. In doing so. it 
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pioneered ihc two methods of achieving the reliability of digital control 
systems that arc still used today. 

Redundancy and Backup: the Apollo Experience 

For the ten years between von Neumann’s lecture and the final specifica- 
tions of the Apollo spacecraft control system, redundancy, cither dual or 
triple, was the basis for increasing the reliability of fly-by-wire control 
systems. For the Apollo Program, size, power, and weight drove the search 
for a single-stnng system of adequate reliability. The Gemini earth-orbital 
spacecraft used a single digital computer on Bights of up to two weeks 
duration (although it was not powered up the entire time). A lunar mission 
was planned to be less than two weeks. Actually, the development of the 
Gemini computer followed the choice of the Apollo control system designers, 
and Gemini missions were partly intended as test flights to explore Apollo 
objectives of long duration, rendezvous, and computer control." The com- 
puters for Ihc two programs were quite different. 

Later called the Charles Stark Draper Laboratory in honor of its famous 
founder, the Instmmentation Laboratory of the Massachusetts Institute of 
Technology had won the contract to develop the Apollo guidance and naviga- 
tion system. The initial digital computer design was based on the Polaris 
submarine-launched guidance computer. 1 ' Draper Lab had to show that the 
Apollo version of this computer and its resident software could provide suffi- 
cient reliability for the lunar mission. The target was 99.8 percent probability that 
the computer would function at any given instant. 1 1 Eldon Hall, the chief 
designer of the computer, quickly calculated that using conventional methods 
of redundancy to achieve the goal would result in excessive size, power, and 
weight. Therefore. Hall’s group decided to use a single computer, and to test 
each component at every spot in manufacture. 14 Phil Fclleman. who worked 
on Apollo and later became manager of Draper’s F-8 efforts, said that "every 
piece of metal could be traced to the mine it came from.’’ 1 ' This decision 
meant that the reliability of the computer system was essentially purchased 
through a massive investment of time, money, and energy certifying every 
part of hardware and software. The gamble paid off: there were 1 6 computer 
and 36 display and keyboard system failures in the 42 computers and 64 
DSKYs 16 built— all on the ground.' 7 With zero inflight failures in 1.400 
hours of operation added to the prcllight operations, the actual demonstrated 
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Die i*)per left section, displays in the upoer right. and the keyboard is in the lower section. 

(NASA photo EC96-434Q8-1 by Dennis Taytor). 


reliability over the life of the program came to '>9.9 percent. ' 

Software quickly became the main driver of cost and schedule. The 
techniques of making reliable hardware were known to engineers before the 
program began. However, ensuring software reliability was still an immature 
process. It remained so for many years. Producing code is essentially a lonely 
act. like writing or making art. Personal styles ranged from composing at the 
keypunch to meticulous preparation by drawing flow diagrams and thinking 
through the logic multiple times. Software managers faced the problems of 
obtaining requirements for the programmers to code and then verifying that 
the requirements had been implemented. They then had to validate that the 
resulting system did what it was supposed to do. In projects with teams of 
programmers, individual coding styles gave uneven results. Therefore, one 
historical aspect of software development is the struggle to get intuitive 
programmers to document their management designs, annotate code, and 
then use repeatable processes, configuration management, and the like. 

NASA wanted to use a more standardized development process for 
Apollo, so it asked Bellcomm. Inc., to do a study of successful software 
development and management techniques. The resulting report is a good 
overview of software project management to this day. although the expected 
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proportions of effort lor different development phases arc somewhat naive. 
Of the 68 pages in the report, just one is devoted to testing. Nonetheless, that 
page contains the first inkling of the detail required to ensure that the soft- 
ware has a reliability level equal to that of the hardware. The suggestion was 
to use five layers of verification:'" 

1 . Subprogram-unit test, which means that each module of the eventual 
software is individually tested to find coding defects. 

2. Consolidation test, in which the tested units arc assembled, piece by 
piece, into the flight software load. 

3. Acceptance test, in which the flight software is verified against the 
requirements as a whole. 

4. Hardwarcy.softwarc integration test, in which the software is tested while 
resident on night-equivalent hardware. 

5. Live-system environment test, in which the software is executed in the 
actual conditions it would encounter on a lunar mission. This meant that 
the true environmental tests were limited to onc-G situations (those in 
which the gravity is equal to that on the earth's surface at sea level) like 
pre-launch, built-in tests, etc. Tests in the zero gravity of space had to be 
in a simulated environment. 

By October of 1%7. the development and verification plans showed 
significant refinement. This was accomplished in the wake of a tragic fire on 
27 January 1967 that killed all three members of the first Apollo crew. That 
flight, had it taken place, could have been embarrassing for Draper Lab and 
NASA because the flight software contained known bugs/ 1 Several missions 
were being prepared at the same time, which resulted in a shortage of person- 
nel and verification equipment. Draper Lab had been extremely optimistic 
when it was awarded the Apollo contract. Its engineers at first expected to 
build all the software with about eight people, a number that eventually grew 
to 300 full-time employees." 

Howard W. (Bill) Tindall, the NASA manager assigned to ovciscc the 
on-board software development, claimed that engineers at Draper Lab began 
skipping unit tests to save time and resources. 2 ' It is harder to fix defects 
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found in integration test than it is in unit test, since it is not easy in the former 
ease to pinpoint the unit responsible for the defect. Therefore, failure to 
perform unit tests actually costs more time later, in that the bugs easily 
repaired in unit tests arc confounded with other, that would only show up in 
integration or acceptance tests. The Draper Lab software managers knew this, 
and skipping tests was not to be a common practice. As the final software 
delivery was pushed back, crew requests for changes were routinely denied. 
Even known bugs could not be fixed because they were in software stored in 
the permanent memory of the computer. Most of these would have work- 
arounds stored in the limited two-thousand-word erasable memory. There 
were also small programs to back up the primary system stored there.'' The 
delay in piloted flight caused by the lire allowed Draper and NASA to clear 
up the software testing jam and begin work on the Block II system that 
actually flew to the moon. There were still small glitches in every flight, but 
nothing serious happened in the llight control and navigation System. 25 

The new development and verification plan of 1967 was intended to 
define a process that made testing easier, a change in emphasis that would 
serve the Apollo and later software programmers well. 16 The plan defined 
milestones used for each flight’s software load that had associated tests. 2 
These provided synchronization points for both developers and managers: 

1 . Preliminary design review ( PDR) is held after the equations intended for 
a flight had been defined and verified on an engineering simulator. 

2. Critical design review (CDR) is a formal review of design specifications 
for the software. 

3. First article configuration inspection (FACl) is held to approve test plans 
and results. 

4. Customer acceptance readiness review (CARR) is to certify that the 
software is ready for manufacturing into the permanent and erasable 
memory loads. 

This set of milestones and the overall plan were to be prepared by NASA 
engineers, w ith significant help from contractors, especially Draper Lab. It 
would then be turned over to another contractor, TRW. Inc., for further 
refinement. By the end of April 1968. it had been split into three plans: 
software development, verification, and management. 2 ’ The four phases of 
testing were more clearly defined in the verification plan:-' 
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1. Engineering language simulations to validate equations. 

2. Bit-by-bit simulation of coding for the guidance computer. 

3. Bit-by-bit and hybrid simulations of collections of programs (steering, 
engine cutoff, etc.). 

4. Mission sequencing (using the programs in mission order). 

The time between the FACI and the CARR was exclusively devoted to test 
groups three and four. 

This process — with its plans for each area of concern, sharply defined 
milestones, and continuous verification of the software at each stage of 
development — is still considered excellent today. It is actually more of a 
goal than common practice. The Software Engineering Institute of Camcgic 
Mellon University recently produced a Capability Maturity Model (CMM'"> 
for software development. " The Institute is a federally-funded research and 
development center with the mission of improving software engineering. The 
CMM is a benchmark used to assess an organization’s ability to produce 
software. There arc five levels of maturity defined in the model. Historically. 
15 per cent of these assessments arc at Level Three or above. The Apollo 
software development process of the 1960s is a Level Three, a completely 
remarkable achievement since the first concerted effort to define and practice 
“software engineering’’ did not occur until 1968. 1: The first group (and still 
one of a handful) to attain a Level Five rating was the Space Shuttle on-board 
software development team of IBM-Houston. which had inherited the best 
parts of the Apollo spacecraft software process. 

All of the verification and validation would be for naught if the software 
did not enter the spacecraft in the exact bit-for-bit form that constituted the 
final version. Since the Apollo computer used permanent memory— woven 
into ropes of ferrite cores and wire— it was extremely critical that the soft- 
ware in the ropes was correct. The ropes could not be changed without 
complete rcmanufacturc. Draper Lab had prepared a process for certifying 
the correctness of rope manufacture as early as the verification plan of May 
1965. ,; This process is representative of the care taken in all aspects of 
development: 

1 . Code is put on 80-column punched cards. 

2. An assembler converts the code to binary on magnetic tape: the tape 
recording has two-way parity checks with error correction. 

3. Simulators use these tapes for testing. 
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4. A rope-weaving tape and a checker tape on Mylar arc created from the 
tested software and arc re-read and checked. 

5. Core ropes arc made from the weaving tape. 

6. The ropes arc tested by the checker tape. 

7. After installation, the Apollo Guidance Computer self-check program 
docs vertical sum checking of the contents of memory (the parity checks 
being considered horizontal checking). 

The chances of an ciror escaping on the last test alone arc less than one 
in three billion. This process was very important to the F-S program, because 
a planned permanent shutdow n of the rope facility meant that there would be 
only a single opportunity to weave its software.' 1 

In the four years between 1964 and 1968. the Draper and NASA engi- 
neers had gone from not really knowing the scope of software verification to 
being able to produce nearly perfect core ropes with only a few non-fatal 
defects on them. They had also included contractors such as Bcllcomm. 
TRW. and General Electric to gain a wider base of feedback. It was this 
software process that the fly-by-wire project would inherit. 

Despite the invested effort and success of the single-string system on 
Apillo. it still made some NASA engineers nervous, and the memory and 
processing deficiencies of the computer added to the discomfort. They 
wanted some insurance. On 1 August 1961. Joseph Shea, the Apollo space- 
craft program director, asked Marshall Space Flight Center to explore using 
the Saturn V launcher's computer as a backup. 1 ' The study showed that there 
was no time in the accelerated schedule to make the modifications, and of 
course, it could only be used when the spacecraft was still attached to the 
booster. There was some discussion of having a software program in the 
Apillo computer containing only those functions absolutely necessary for the 
return to Earth, lest some undetected error in the main programs anise. 
However, there was no room for it in the limited memory. Another orphan 
safety function was the rctum-to-earth abort from within the sphere of the 
moon’s gravity (about 64.000 kilometers in radius). The Draper team did 
manage to squeeze in a rctum-to-earth feature from within the earth’s gravity 
field. In the end. the abort from the lunar sphere was finally handled by pre- 
computed tables in handbooks, a non-software solution. 15 

Even the most confident engineers did not want to leave one aspect of 
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the Apollo mission to a single-string system: the lunar landing itself. A 
computer failure at any point in the lunar module’s flight would almost 
certainly be fatal to the crew. Since redundancy had already been rejected 
due to limits on size, power, and weight, some form of backup would have to 
be used. Backup in this context is a system that provides safety but docs not 
provide full functionality. A redundant system would provide full functional- 
ity. NASA contracted with TRW to produce a small eight-bit computer called 
the MARCO 44 1 8 to be the heart of an Abort Guidance System (AGS) for 
the Lunar Module. Initially, the AGS was intended to provide guidance 
capability to the crippled spacecraft all the way to a rendezvous with the 
command module. This requirement was quickly scaled down to simply 
being able to put the lunar module into orbit. The command module would 
use its more sophisticated guidance programs to find and retrieve the two 
astronauts on board. TRW used the same ponderous and effective verification 
plan as the Draper Laboratory. One report stated that it took an average of 
nine months to approve, implement, and test a software change, a testament 
to the inherent size and inertia of such a grand testing scheme. 16 

Despite the general acknowledgment that redundancy would be the most 
reliable design for a flight-control system, as the l%Os drew to a close only 
the CF-105 Arrow had used that scheme. Even though the Saturn V' was 
much larger than any previous (or later) booster, its payload weight was so 
limited that it prohibited redundancy in the Apollo spacecraft. 17 Thus, its 
designers chose to use a backup scheme. Both the dual-redundant Arrow and 
the simplex-with-backup Apollo were designed with military pilots or 
astronauts in mind, people who had many more dangerous concerns than the 
possibility of computer failure. It was the desire to move this technology into 
the civilian realm, in commercial aircraft, that forced the adoption of deep 
redundancy and backup schemes together. 

The Reliability Scheme for Phase I of NASA’s Digital Fly-by- Wire- 

Project 

It was generally acknowledged that the simplex system ased in Phase I of 
the F-8 project would be a proof of concept. The real payoff for commercial 
manufacturers would come with the redundant system in Phase II. However, 
even though the mechanical controls were completely removed from the F-8 
during its conversion to fly-by-wire, there was never any intention to fly 
without a backup. The decision to provide safety with an analog system 
reflected the confidence in the overall concept of fly-by-wire that was 
demonstrated in other programs. * The Air Force’s analog fly-by-wire 
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system hud d goal of 99.999977 percent reliability during a two-hour 
mission.** NASA eventually wanted to demonstrate 99.9999999 percent 
reliability with the F-X.*° In contrast, a speaker at the Air Force’s 196X 
conference on fly-by-wire technology reported that a triplex stability aug- 
mentation system for the SR-71 had achieved 99.95 percent reliability, 
comparable to Apollo. 11 He revealed calculations that demonstrated a 
quadruplex system would achieve 99.99065 percent reliability, with FAA 
records showing commercial aviation historically at 99.999565 percent. 1 ' 
Therefore, the F-8. if successful, would be significantly more reliable than 
commercial aircraft— a worthy goal. The use of dissimilar primary and 
backup systems in Phase I would achieve progress toward the eventual 
reliability figure, as the analog backup augmented the Apollo computer’s 
99.9 percent reliability. Achieving still higher reliability would have to wait 
until Phase II. 

Draper Laboratory Becomes Directly Involved 

Soon after Neil Armstrong suggested the use of an Apollo computer on 
the F-8. the wheels began turning to incorporate the needs of the project into 
the continuing work at Draper Lab. Because of the Draper Laboratory’s 
unique position in designing the overall Apollo guidance and navigation 
system. NASA awarded the development of the F-8 digital system under a 
simple contract process. Philip Felleman was assigned as the first project 
manager for the Draper Lab. He was trained as a mathematician and had 
joined the Laboratory in June 1954. Felleman began his career in airborne 
fire control and then had several jobs during Apollo, including software 
design and management. He met with Mel Burke, and later Cal Jarv is and 
Ken Szalai. beginning a relationship with the Flight Research Center based 
on mutual respect that lasted 15 years. Ken Szalai would later refer to him as 
"my hcni.” 1 * 

The Center set four design rules for both organizations to follow: 

1 . There would be no mechanical reversion. This forced the use of fly-by- 

wire completely. 

2. There would be no changes to the Apollo system except software— thus. 

the hardware verification and validation would be inherited intact. 
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3. The pilot interface would be kept simple. It would provide access to 
flight-control functions rather than direct access to the computer. In fact, 
the DSKY wound up in a gun bay. It was accessible to the ground crew 
only, not the pilot. 

4. Aircraft handling qualities would meet or exceed those provided with 
the mechanical system.** 

Fellcman was excited about the potential for fly-by-wire and was con- 
vinced Draper could meet the objectives. He and others brought into the 
project were riding the crest of a tsunami of self-confidence gained through 
their Apollo experience. Working with a small group of NASA engineers 
with such a focused goal was attractive. The entire program for both NASA 
and Draper was small, involving about 10 people in Cambridge and eventu- 
ally 25 in California at any one time, with only about 10 of those concentrat- 
ing on software. In contrast, at Draper the Apollo program absoibcd 400 
person-months’ effort each month (including those temporarily assigned). 45 
These two software teams quickly developed close relationships.*” 

Draper assembled a software development support infrastructure specific 
to the F-8. It consisted of an Apollo Guidance Computer, a DSKY. a core 
rope simulator, and initially an Apollo hand controller instead of stick and 
rudder: this mirrored the Apollo infrastructure. The hand controller caused 
some difficulty in testing the software, since it did not match an aircraft’s 
controls. It was replaced by an F-8 cockpit obtained from a U.S. Marine 
Reserve F-8 squadron, stripped down so that the artificial horizon, altimeter, 
airspeed, rate of climb, thrust, g-meter. and anglc-of-attack indicators were 
the only instruments working. Takeoff, taxi, and landings would have to wait 
to be done in the Iron Bird simulator at the Flight Research Center (sec next 
section). An XDS 9300 engineering computer did transformations between 
parts of the simulator. Even though Draper was initially brought into the fly- 
by-wire program because of its expertise with the flight computer, it was 
overall software development capability and support infrastructure that 
ensured the Lab would be involved for the long haul. 

Reflecting, cnginecis from Draper fondly remember the F-8 project 
because it had discrete, tangible, positive results. Vincent Mcgna. the pro- 
gram manager for Phase II. relates that working on missile guidance was 
significantly less rewarding.*' Although able to sec many successful test 
shots on such a project. Draper engineers never hoped to see actual use. On 
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the other hand, developing digital fly-by-wire revolved around frequent 
Hying and tweaking the system for increasingly better performance and 
reliability. The project participants sought perfection with hopes that their 
design would be the flight-control system of the future. Furthermore, 
younger engineer, on the project were often taken to the Flight Research 
Center to present their work during reviews. This gave them exposure to the 
entire NASA-Drapcr team, a valuable experience. The Flight Research 
Center's participants, in turn, acquired Draper's pervasive can-do attitude and 
the ability to carry that confidence into later projects. 

Developing the Flight Software 

With the F-8 program, the Flight Research Center attempted to adopt the 
new role of system integrator. Previously only responsible for flight research. 
Jarvis' team would integrate and validate software developed by Fcilcman's 
group and ultimately decide if it was suitable for piloted flight. Draper Lab 
remained responsible for requirements analysis, software and interface 
design, simulator support, and flight-test support. Delco (AC Spark Plug 
when it won the Apollo computer hardware contract ) also provided simulator 
and flight-test support, maintained flow charts of the software, and provided 
training on it for the Center. Hydraulics Research and Manufacturing built 
the secondary actuators, and LTV (formerly Ling Temco Vought) helped with 
the aircraft." 

Jarvis eventually assigned seven engineers to verify, validate, and 
integrate software. NASA's "Stage I" simulator for these tasks consisted of a 
simple breadboard with analog models for the flight-control laws. The next 
stage included some real hardware and better analog circuits. Finally, the 
team built and used the Iron Bird simulator for the work. The Iron Bird 
resided in a hangar at the Center for over 15 years. It was an F-8 electrically 
“alive." and all the hardware associated with the fly-by-wire system (comput- 
ers. backup system, and actuators) was installed on it. iJ Software running in 
the Iron Bird would demonstrate its readiness for the actual flight hardware. 

In fact, the hardware in the simulator was flight-qualified and available as a 
spare.'" This simulator rapidly became one of the most useful parts of the 
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program. Typically, control law development began with exercising the 
equations on an analog simulator, doing a linear analysis using a digital 
computer, coding it. and finally validating it on the Iron Bud/ 1 This would 
help find any unforeseen shortcomings before committing to flight. For 
instance, engineers working w ith the simulator discovered that additional 
failure logic was needed on the various data channels. The fix was made 
prior to permanent rope manufacture. Both Draper Lab and the Flight Re- 
search Center increasingly relied on the Iron Bird for verification throughout 
the duration of the program. u 

As the project officially got underway in January 1971. the immediate 
goal was to develop and verify the sof tware that would be located in the 
permanent rope memory. The software had to be completed and delivered to 
the rope weaver, at Raytheon before the year was out in order to give them 
enough time for manufacture before the July 1972 shutdown of the facility. 
The most critical time was from the March 1971 delivery of the initial 
specification until the mid-December goal for software release. 4 ' The two 
thousand words of erasable memory would be held for changing parameter 
values and any last-minute fixes. There was little expectation that the require- 
ments definition would be other than an iterative process. No one had 
designed software for airborne fiight control. There were several open 
questions that previous spacecraft experience could not answer. Cal Jarvis. 
Chief of the Systems Analysis Branch. Dwain Dccts. and Ken S/alai (a man 
for whom the term “whiz kid" might have been invented) worked closely to 
answer those questions in the Phase I software specification that would be 
delivered to Draper for implementation. S/alai took the pitch axis. Dects the 
roll axis, and Jarvis (initially) the yaw axis, though project management 
duties later caused Jarvis to give up his part. 51 Ken S/alai then assumed 
responsibility for the yaw axis. 

Dcets and S/alai had worked together on a previous project. Dccts came 
to the Center from a master’s program in physics in 1962. He was assigned to 
a variable stability aircraft project, which was using a modified F-100 fighter. 
Within two years. Dcets became project manager of a more ambitious 
experiment: converting a Lockheed JctStar corporate jet into an airborne 
simulator. The flight controls could be tuned such that the JctStar could act 
like any one of a variety of aircraft It was an analog system, and Dcets’ 
experience with its modif ication increased his interest in software and made 
it more attractive later. Szalai trained as an electrical engineer and joined the 
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JctStur project fresh out of college in 1964. He actually came close to reject- 
ing NASA’s offer, initially agreeing to join the Cornell Aeronautical Labora- 
tory. But. luckily for the Flight Research Center and NASA as a whole, he 
changed his mind and called, before his letter declining the offer arrived in 
California, to say he was coming. S/alai would later recall that the JctStar 
project was a real education in (light dynamics and controls. Flying in the 
aircraft, he could feel and see on the strip charts the effects of control system 
inputs and outputs. He was also able to work closely with pilots and learned 
how they helped shape a research program. After the project ended. S/alai 
had nearly a year to do some studying tin other projects and coincidentally 
chose the Apollo guidance and navigation system/' 

Dccts and S/alai experienced difficult problems while building the 
software specification mainly in: I ) the use of a digital system in a previously 
all-analog world, and 2) the encapsulation of the computer behind an analog 
interface to the airplane. At the input end of the computer there was an 
analog-to-digital converter: at the output end. a digital-to-analog converter. 
When the pilot moved the stick, displacement translated to voltage. For 
instance, in the pitch axis, the limit of physical movement was 5.9 inches 
(nose up) toward the pilot and 4.35 inches (nose down) away from the pilot. 
The transformers were designed to generate a signal of plus or minus three 
volts. Therefore, the input to the analog-to-digital convener was scaled to the 
longer aft movement, so the forward movement had a maximum value of 
about 2.4 volts, while the aft movement topped out at -3.0 volts. The voltage 
from the transformers would be converted into bits and then serve as input to 
the software control laws. 

At first glance, the control laws seemed straightforward. If the pilot 
wanted to climb, he or she added power, then pulled the stick back: the 
elevators then moved proportional to the stick movement. However, the 
process did not prove to be that simple. For instance, control devices in each 
axis have a deadband region in which small movements have no result. In a 
mechanical control system, the deadband is caused by stretching of the 
control cables from age and use. The deadband varies over the lifetime of the 
aircraft and cables. It is different in each axis and definitely unique to each 
airplane. Maintaincrs and inspectors try to minimize its effects, but in a fly- 
by-wire system even small discrepancies arc somewhat magnified. If the fly- 
by-wire designers ignored the deadband, the control surface would move in 
accordance with every tiny motion of the stick and rodder pedals. The 
airplane would then be too sensitive to fly without the occurrence of pilot 
induced oscillations that result from constant attempts to damp motion. The 
deadband regions could only be determined by iteration and disciplined tnal 
and error. 

At the output end of the computer, signals causing gearing gains had to 
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Diagram showing the F-8 Dgiial Fly-By-VAre Phase I system metfianlzation. (Taken from NASA 
TN 0-7843. p. 33). 


be property calibrated. Movement of a control device in inches was trans- 
lated by the control laws into movement of the appropriate control surface in 
degrees. This gearing was non-linear. In roll, small stick motions were 
handled sensitively, while the system translated large stick motions less 
sensitively. Without this accommodation, the aircraft would maneuver more 
violently than the structure or pilot could stand. Initially, this "stick shaping" 
was done by hardware, adjusting a linear variable differential transformer to 
prov ide parabolic shaping. The result was incorrect quantization of the 
output. This prompted the engineer, to use software to shape the stick 
movements. The quantization problem was eventually fixed in this medium. 
Szalai recalled that this particular situation was another case of how you had 
to always keep the entire system in mind when looking at any subsystem.'*' 

Equations to handle deadband and gcanng were the heart of the control 
laws. As an example, one law in pitch was pilot trim control. The output to 
the actuators was a sum of the tnm command from the electric trim button tin 
the stick (often called the "coolie hat” because of its looks) and the product 
of stick gearing gain and the stick deflection. The stick deflection was 
adjusted by factoring out the deadband. 

For a nosc-up trim command of +2 degrees, a deadband value of I inch, and 
nominal gearing gain, a pilot trim command would come from the computer as 
7.3 degrees. An analog voltage representing 7.3 degrees traveled down the two 
output channels (the active and a monitor) to the secondary actuators. Tliese 
would cause the hydraulic actuators to move the control surface. 
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The value ranges. constants, and gains had to be determined by careful 
analysis and simulation. Also, since the team used a digital system, its 
members were required to determine a sampling rate and command quantiza- 
tion. Analog computers take continuous signals as input and output. Digital 
computer, have to receive and send at discrete intervals, but fortunately, 
these interactions arc at high speed. Every 30 milliseconds, a sampling and 
calculation cycle took place. Within that cycle, the mainline control calcula- 
tions would be updated every X to 15 milliseconds.' The frequency of the 
output commands was initially too low. The first time they were tested in the 
Iron Bird, the stepping movements of the actuators caused a tremendous 
vibration. The output was smoothed by further trial and error. This is a 
further example of how the program could not have survived without the 
simulator.. It is also an example of how digital systems have advantages over 
analog systems. The smoothing was accomplished with a pilot prefilter in the 
software, done before the permanent rope manufacture. This incurred no 
schedule delay, whereas in an analog system, hardware would have needed to 
be changed, a longer-term proposition. 

Despite the difficult nature of these problems, the team at the Flight 
Research Center looked forward to applying logic encapsulated in software 
to the flight-control problem. As 1971 progressed, the difficulties inherent in 
software development became clear. Dects and Szalai reported that the use of 
logic "had a significantly greater impact on software complexity and verifi- 
cation than was anticipated.’ ” 1 Fortunately, the Draper Lab had a software 
architecture that simplified construction and experience with the esoteric 
sensors used in Phase 1. No one would have purposely chosen a system for 
aircraft where gimbal angles have to be converted to numbers representing 
the speed of motion in each axis, when rate gyros provided the data directly. 
Gyros arc devices that have a spinning element that remains oriented in space 
in spite of movement of an airplane or spacecraft. Gimbals, in this sense of 
the word, arc the part of a gyro on which the spinning element is mounted. 
The Apollo inertial navigation system used gyros that did not have the ability 
to calculate rate information internally: this was left to the computer. 

Exploratory work eventually led the project to the software requirements 
specification. This was delivered to Draper and a series of ten-hour clarifying 
phone calls began. The control law equations were written into the specifica- 
tion. arranged by axis and functional groupings, with no attempt to order 
them as they would be handled by the flight software. This made them 
implementation-independent, though more difficult to use. Although titled a 
“specification." this aspect made the document more of a "requirements" 
document than a specification. Draper Lab prepared the specification of the 
software from it. The variable names were cryptic and at first incomprchcn- 
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siblc to an outsider. Tlic follow ing equation is an example: 


DEC1=<KGEI (DEPI+DETl 

DE meant •‘delta" or "change." C is "command." K is “constant." GE is 
"gearing." P is “pilot." and T is "trim.” The equation can be loosely trans- 
lated as: "The command change equals the gearing gain times the pilot stick 
position plus the change in trim.” The ranges and values arc located in tables 
at the end of the document, causing a bit of "two-finger” exercise to read it. 
The variable names were different for each axis, and the control laws were 
not "set" for a long time, though they continuously built upon each other. 

S/.alai says that the Draper Lab software developers "made" the F-8 
program.”' Fclleman recalls Robert "Barney” Baimsfather meticulously 
going over the specification, creating flow diagrams, writing code, and not 
even approaching a compiler until he was sure his program was right.'” Few 
defects were found in his work, but getting all the numbers right was a 
learning experience. The software developers were limited to fixed decimal 
point arithmetic, which required scaling by hand to achieve the greatest 
accuracy, again by some tnal and error. 

The specification required over a dozen revisions before its final version 
was published in March 1973. about a month after the first version of the 
Phase II specification! Uncontrolled change would have destroyed both 
schedule and budget. The many changes to the specification were managed 
by a four-layer system. 61 The lowest impact were Assembly Control Board 
requests— relatively straightforward code changes that could be approved by 
the software manager at Draper. Next highest was an Anomaly —an error that 
needed to be repaired. Both the Center and Draper software manager signed 
off on it. Next was a Draper-originated Program Change Notice— during 
development something could not be implemented in the desired way. so the 
implementation had to be changed. Again, both managers signed. The highest 
level was a Program Change Request— a change to the specification. Both 
software managers and the project manager had to approve this, as there 
usually were schedule and budget impacts. 

Baimsfather and the others built the software using tools developed for 
Apollo. The assembly language system had acquired some nice features that 
eased long-term development, such as diagnostics, a basic and interpretive 
language, flexible memory allocation, cross-reference tables for variables, 
and the separate assembly of modules that could be integrated later. The 
interpretive language allowed list processing, thus making matrix arithmetic, 
use of vectors, and double- and even triple-precision numerical representa- 
tions possible. The program was reviewed by "cycballing effort”— a primi- 
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live peer inspection— then tested via the various simulators until its release 
from Draper to the Flight Research Center. 

Finally, a man named Al Jingle got to name the software. This was a big 
deal since all the names of the Apollo flight software loads had something to 
do with the sun (SUNDISK. SUNBURST. SUNDIAL, etc.). Engle chose 
DIGFLY. which was supposed to be pronounced as “dig-fly." However, to his 
consternation, it was often mangled to “didge-fly," obliterating the intended 
reference to the digital system. 

There were two copies of DIGFLY in the core rope. 6 - It was the lone 
program assembly, in contrast to Apollo software with separate programs for 
different (light phases. DIGFLY was divided into system and application 
components. The system software consisted of an executive that provided 
task management, a restart segment that could rc-initializc hardware and 
software in flight, and service routines to monitor the inertial measurement 
unit, provide self-tests, control the interface, and handle interrupts. The 
application software had flight control and some miscellaneous components. 
The flight-control portion did the mainline processing of the control laws, 
handled the mode and gain changes made by the pilot, and processed input 
from the sensors. Arming the miscellaneous components were ground-test 
software and special-purpose applications. 

Since parts of the software were similar to the Apollo code, some of it 
could be reused like the hardware. The display code, executive, and inertial- 
measurement unit alignment were taken from the Apollo 14 lunar module 
flight software load. The self-tests came from the Apollo pre-flight erasable 
memory load. Sixty percent of the eventual F-8 software was taken from 
Apollo. 6 ’ 

Despite the expectation that the software was correct and the hardware 
robust, the switchover to the analog backup flight system was carefully 
designed. Draper Lab used computer restarts as a solution to what were 
hopefully transient problems. Various logic emirs could cause a restart: a 
parity failure in a data transfer (the bit used for parity checking was a 0 
instead of 1. or vice versa), an infinite loop in the computations, an attempt to 
access unused memory, or silence from a running program.’' The most 
famous and disconcerting restarts happened for a different cause on the first 
lunar landing. The computation cycle was shared by multiple programs, each 
getting a few milliseconds to do one cycle. The total time of the cycle 
exceeded 20 milliseconds, which was the limit. The computer did a restart, 
but the problem persisted. A nervous flight director received assurances from 
the computer specialists in a room adjacent to Mission Control that the 
restarts, though irritating, were normal. Draper wanted to allow three restarts 
in the F-S before the digital channel was declared failed. As it turned out. this 
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The Apolto hardware jammed nlo ihe F-8. The computer a parbaly visitte n the avionics bay at 
the top ol Ihe fuaetage behind the cockpt. Mole Ihe OSKY In live gun bay. (NASA photo E-24741). 
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could lake up lo one second, which was extremely long lor a high-speed 
airplane. Thus, the requirement was changed: any one failed restart would 
cause a sw itchover to the Backup Control System (BCS)/* 

There was one area of redundancy in the primary system that had to be 
actively managed by software. Two output channels, an active and a monitor, 
went to each secondary actuator. The actuators themselves were triply 
redundant, but that redundancy was handled by voting at the actuator itself. 
All of the three actuator outputs were compared one with the other, and 
essentially the majority ruled. In the case of the data channels, they had to be 
monitored for consistency. If they failed, there was an automatic switchover 
to the BCS. 

During all of 1971, personnel, telephone calls, and paper flowed from 
coast to coast as the software took shape.®* Results from testing in computer 
simulators and the Inin Bird were folded back into the software specification 
and then to the grow ing volume of software. In the Apollo computer, several 
programs could he active, each given a slot in the computing cycle. The 
DIGFLY was named P60. It became a source of frustration for Jarvis’s 
software subteam, whose members were surprised by the demands of test and 
analysis in a flight program."' Line-by-line verification was the norm. As the 
day of rope manufacture approached, it became clearer that they had indeed 
gained control over the software and a full understanding of its role and 
capability. In the meantime, another subteam, led by James R. Phelps, was 
methodically converting NASA 802 to a fly-by- wire testbed for the Phase I 
Bight program. 
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Chapter Four: Converting the F-8 to Digital Fly-By-Wire 


NASA's Flight Research Center was lucky enough to get a true high- 
performance fighter for the digital ily-by-wire program. For technology 
transition purposes, the military would take a demonstration of a new flight 
control paradigm more seriously using one of its aircraft than if the Center 
had used. say. a corporate jet. Commercial manufacturers perhaps would 
have been more easily sold by a modified Boeing 737. but at least they could 
consider that the flight envelope (speed, altitude, and maneuvering) on a 
military aircraft was larger and more difficult than anything they would 
immediately need. Even though the eventual aim of the digital flight-control 
effort was to influence the design of nearly all aircraft, it was acknowledged 
that the military services were the most likely early adopters. 



The F-8C Crusader on ihe ramp a! the Flight Research Center in its original Ir.cry. (NASA photo 
E-20095). 


The Navy’s specification for the Vought F-8 Crusader went out for bid 
nearly 20 years before NASA's fly-by-wire project started. The first carrier- 
based supersonic fighter, it became one of the first production aircraft of any 
type to exceed 1. 000 miles an hour in level flight. In 1957. a then unknown 
Marine major named John Glenn set a speed record in an F-8. crossing the 
United States in three hours and 23 minutes. In the Vietnamese conflict, the 
F-8 became known as the "MiG Master.’' shooting down 19 enemy aircraft 
while operating off of smaller fleet carriers like the Ticonderoga and the 
Hancock. Some attribute its success to the four 20mm cannon it had as 
primary armament. While F-4 pilots were practicing long-range missile shots 
in their gunlcss interceptors/ fighter-bombers, the F-8 air-superiority flyers 
were closing to gun range much like their brethren in World War I. World 
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Mention of Ihe F-8 DFBV/ learn moving the fuselage of the Iron Bird from under the wing after 
the end of the project. (Unnimbered NASA photo). 


1 Burrell Tillman. MIG Master. 2nl ed, (Anmpct i>. MD: Naval InxitoK Pre*i. 1990). Ihwauion with 
Cuptuin Ri.tiud Munin (ret. I. who lieu the F-8 in Vietnam and later commanded an F- 14 squadrea. 
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War II. and ihc Korean War. Even though the sole use of guns yielded only 
two of the 19 kills, to many pilots the aircraft was the "last gunfightcr.” 
remembered with nostalgia by later F-14 drivers armed with 75-milc range 
missiles.' It was fortuitous for NASA that the Agency got a plane with large 
internal gun and ammunition bays. The new avionics boxes could easily fit in 
the space freed up by removal of the weapons. 

The Flight Research Center received four F-8s. One was used on the 
Supercritical Wing experiment, one became the Iron Bird simulator, tail 
number 802 was converted to fly-by- wire, and number 816 was kept intact to 
he used by research pilots for familiarization and proficiency. The simulator 
aircraft arrived on 28 March 1971. and the team led by James R. Phelps 
immediately began opening panels and clearing the future avionics bays. One 
month later, on 27 April, aircraft 802 had its 37th NASA flight (the first 36 
being for general pilot familiarization and not part of any specific project) 
and the next day went in for modification.' Thus, the Iron Bird conversion 
would slay ahead of the flying airplane conversion, providing valuable 
knowledge. The two aircraft sat side-by-side in the hangar, allowing techni- 
cians to move between them. 

The most remarkable thing about the conversion activity was that there 
were no remarkable things: all the problems were manageable. As Phelps. 





key avionics engineer Wilton P. Lock, and their colleagues worked diligently 
along, difficulties would come up ami be either quickly dispatched or over- 
come by sheer persistence. These ranged from the usual, such as a badly 
fitting canopy, to the bizarre. like the sweatshirt that had flown 37 times un- 
detected in a fuel tank on NASA missions. When participants were asked the 
question “What was the most difficult problem?" they uniformly answered 
that they could not think of one. Phelps recalled that it was like "climbing a 
mountain." 1 He did not feel pressure to make a certain date, which he 
attributes to Jarvis' management style. Everyone felt an urgency to complete 
work and gel the airplane in the air. but not at the expense of cutting comers. 

The key enabling technologies for fly-by-wire arc computers, sensors, 
and actuators. The F-8 conversion involved all three, with two types of 
computers, digital and analog. In a little over a year, aircraft 802 would be 
internally transformed, while retaining its fighter-plane exterior looks. 

Installing the Apollo Digital Computer System 

The main problem with using the Apollo guidance computer and its 
associated systems was that it needed active cooling while it was running. It 
was not designed to be air-cooled, so the computer and the cooling system 
had to share space. The F-8 has a good-sized avionics bay behind the cockpit 
and above the gun bays. Removing the guns and ammunition allowed the 
auxiliary avionics, the DSKY. and the backup Right system to rest in the gun 
bays, leaving the original avionics bay for the computer and the inertial 
platform with the gyros— and the coolant system. 

Throughout the conversion process, nothing caused a longer string of 
difficulties than the coolant system. The idea was to build a pallet plumbed 
for liquid cooling. The pallet would be shipped to Delco and the Apollo 
equipment installed. KECO. of Santa Ana. supplied a liquid nitrogen and 
ethylene glycol system that used a coolant loop to create cold sinks, which 
would absorb heat adjacent to the computer and inertial measurement unit. 
This came to be called the "glycol system" or "KECO" for short.* According 
to Phelps' log. the plumbing started in California on 1 1 June 1971 . after 
Delco made final recommendations about the placement of the avionics 
boxes. It was shipped to Minneapolis by 25 June, and by mid-August Delco 
had the hardware installed and was doing vibration tests. On 16 September, 
the pallet arrived back at the Flight Research Center. 

On the 24th. the first glitch cropped up: the cold plate inlet and outlet 
plumbing had been reversed, necessitating that a new line be built. The next 
problem was the lack of cooling endurance. Even though the optimum 
cooling time was shorter than desired, about an hour and a half, tests showed 
that the hardware stayed within temperature specifications for two hours and 
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The Apollo guidance computer and the inertial system on a pale! Mote tubing to carry coolant 
among the cold plates. (NASA photo E-23287). 
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ten minutes, longer than the expected pre-flight, flight, and post-flight total 
time. In January 1972. the team executed the paperwork to lower the actual 
specified operating time to one hour twenty minutes from tine hour thirty 
minutes, even though the nitrogen lasted up to one hour and thirty-five 
minutes in some tests. 5 There arc frequent notes in Phelps’ logs about the 
coolant system troubles all the way up to the first flight. KECO sent a 
representative to the Center to see personally what the problems were. Ken 
S/.alai remembers the fellow saying that the real problem was that “you guys 
arc trying to cool the world!'" Ironically, after all this work, one day some- 
one forgot to turn on the cart with power to the coolant system during a 
ground test. The avionics on the pallet ran for over an hour with no cooling 
until they triggered an overtemperature warning. No damage resulted, but 
once again human beings demonstrated that they are the cause of many 
technological failures. 

Pallet number one. plumbing repaired, was in the Iron Bird on 28 Sep- 
tember 1971 and powered up two days later. The next day the flight pallet 
arrived, and could be installed in 802. The hardware in the Iron Bird meant 
that the software would be exercised in an aircraft before shipping it to 
Raytheon for rope manufacture. As late as July 1971. Jarvis hoped the 
software would be ready by late September* It was fortuitous that it was not. 
because it could be tested yet again in the simulator w ith the actual hardware. 
The closer to the flight environment the software could get before being 
frozen in femte. the better. Even then. Jarvis’ revised schedule, issued 4 






November 1971. called for ihc software development to halt on the 16th. 
followed by a month of test, then shipment to embed it in core rope. These 
ropes would return toward the end of January 1972 and be used for further 
testing. A second version of the software. D1GFLY2, would include changes 
indicated by test results and some further work by Draper Lab. It was also 
scheduled for a month of testing before it. too. would be put into core rope, 
with Skylab's software the last ropes made for an Apollo computer.® 

For pilot input to the computer system during these early days. Jarvis 
found two lunar module hand controllers. One had been cold-soaked in a test, 
so it was surpluscd by the Apollo Program as not usable for flight but was 
fine for the simulator. The second, rejected because an astronaut did not like 
the feel, was to be used later in 802. perhaps as a side-stick. For the ground 
crew and test input, they installed a DSKY in the left gun bay. When pow- 
ered up. it blew out, due to a mistake in power requirements. It was replaced 
by a DSKY from the command module of Apollo 15. having freshly returned 
from the Moon." 1 

The Backup Flight System 

Even though the digital system was the focus of the program, no one 
would fly it without backup. The analog backup system down on the F-8 
DFBW airplane was a fairly mature technology. At the Flight Research 
Center, analog circuitry was used as the basis for airborne simulators. Multi- 
threaded analog flight controls were introduced on the F-107 and RA-5C test 
aircraft in the 1960s." The later lifting bodies test-down by NASA had 
stability augmentation and control augmentation systems based on analog 
computers. The M2-F1 was light enough to get by with a mechanical system 
with no hydraulics. Designers felt that its heavier and faster successor, the 
M2-F2, would suffer from pilot overshoots and oscillations with these 
controls. Therefore they added an SAS (stability augmentation system) that 
sensed pilot inputs and sent opposing signals to the control surfaces. Both the 
pilot and the SAS had 50 percent authority in the system, so it acted as a rate 
damper, slowing the results of pilot movements and smoothing maneuvers. 
The X-24A had a triply redundant analog control system built by Sperry." 
These projects gave the team at the Center a base of experience on which to 
build. The success of analog systems on the Air Force’s B-47 dy-by-wirc 
testbed aircraft and the intended use on the F-4 dy-by-wire aircraft added 
some confidence." 

Ironically, in its later production models, the F-8C already had an analog 
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system lhal was no longer needed with a fly-by-wire design. Called the "ap- 
proach power compensator.” it consisted of a computer, accelerometer, servo 
amplifier, and actuator, and it used the existing anglc-of-attack detector. All 
components weir in the left main wheel well except the actuator, which was in 
the engine bay. Its intended purpose was to maintain airspeed within plus or 
minus four knots on landing approaches. It could only be engaged when the 
aircraft was in a wing-up configuration. The pilot would set up for the approach 
to the carrier, ami the accelerometer and anglc-of-attack sensors would send 
signals to the computer. As long as the acceleration was one g and the angle of 
attack optimum, the compensator had nothing to compensate and did nothing. If 
the computer determined that cither value changed, it hail to decide whether they 
offset each other or intervention was necessary. If the aircraft needed a power 
change to maintain a good approach, the computer sent a signal to the servo 
amplifier that amplified it on the way to the servo actuator. The actuator moved 
the fuel control cross-shaft which mechanically changed engine power and 
throttle position. 14 It was in effect a primitive auto-throttle, a more advanced 
version of which is in most commercial aircraft texlay. The converted F-XC did 
not have automatic engine controls of any sort. The stability and control aug- 
mentation systems were to provide sufficient lx* Ip on approach. 

The system installed in the F-XC hail three analog computers in the right gun 
bay connected to the sensors and actuators. Speiry. the analog computer supplier 
to several previous Center projects, pnxiuccd these computers as well as the 
three destined for the Air Force’s F-4 fly-by-win: airplane. On that aircraft, tail 
number 6X0J. they would be the primary system, and Wilt Lixk thought that 
NASA was second in Sperry’s eyes to that higher-visibility project." James 
Moms, the Air Force counterpart of Cal Jarvis, recalled that his team ignored the 
NASA work. : '' Jarvis also remembers not paying much attention to the Air Force 
effort, since it did not use digital computers. 1 However, his logs demonstrate far 
more knowledge of Morris’ program than his Air Force counterparts hail of his. 
An entry for 25 August 197 1 said he learned that 6X0J might fly as soon as mid- 
February. supposedly winning the fly-by- wire race for the Air Force." Gary 
Kner recalls that the NASA and Air Force project pilots had a gixxl relationship, 
with exchange of information on each other’s airplanes. Jarvis and several 
mcmbeis of his team were able to track the Air Force pmjecl quite closely. Krier 
remembers that there was a "race" going on. even if nobixiy told the people at 
Wright- Patterson AFB. When 68QJ flew on 29 April 1972. Jarvis’ team was 
initially crestfallen. When it found out that the F-4 still had its mechanical 
contml system, and that 6X0J hail taken off with it. not engaging the fly-by-wire 
system until in level flight, they felt much better. They were convinced that their 
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debut (light a month later would be the first time an aircraft would be completely 
fly-by-wire, including both primary and backup systems. 1 '’ Ironically. Jarvis. 
Kricr. Szalai. Lock, and Morris were unaware of the Canadian CF- 105 Arrow, 
which flew with a dual -redundant analog system with no mechanical (or other) 
backup in 1959." 

The primary system on the F-8 had a liberal number of gates to the backup 
system. On any inputs that did not match up (for instance, both positive and 
negative trim requested simultaneously), the primary would automatically 
"downmode” (revert) to the backup control system (BCS). This would also 
happen in ease of computer self-detected failures, power failure, and the loss of 
parallel outputs to secondary actuators (which were supposed to receive multiple 
copies of commands). 21 The pilot had contml over the BCS engagement via 
three push sw itches on the mode panel located in the top center of the instrument 
panel in the aircraft. Each sw itch engaged one axis. The pilot could also select all 
three BCS axes simultaneously with a paddle switch located on the center 
control stick. This was primarily for emergency downmode to the BCS in the 
event of a significant control problem with the primary digital system. Different 
gains could be selected using rotary switches. To make the switchover easy, 
integrators in each axis tracked the primary’s commands: that way they could be 
used as the initial orders to the system, avoiding transient spurious commands. 



A card Itoen the Backup Flight System. Note tripe* voter module! at me let! ot the lowest row. 
(NASA ptioto ECN-7597). 
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Al least once per flight the pilot engaged the BCS to align the ineitial platform. 

The fact that the BCS itself was a triplex system meant that it needed to have 
redundancy management. The technique used on the contcmporaiy similar F-4 
system is called “mid-value logic." The three outputs arc compared and the 
middle voltage value is sent to the actuators. This was later used on the F-16A 
and F-16B. which have triple-redundant analog computers as the heart of their 
flight-control system. 

The analog system needed a separate power supply to complete its installa- 
tion. as the Apollo computer was fairly hungry in that regard. The backups to the 
power supply were 24- volt batteries that could keep the BCS mnning for an 
hour. These were constantly trickle-charged by the primary power supply." 

As with the software in the Apollo system, the computer, in the BCS needed 
some changes that were discovered during the ground-testing phase. The 
problem was that changes meant hardware changes, not a few computer words. 
Here is where design and manufacturing efficiencies intended to help maintain 
Speny's brisk computer business actually worked against a Bight research 
program. Speny had begun to manufacture analog computer circuits in small 
plug-ins containing several resistors, amplifiers, and the like, in one package. 
These were further installed in small boxes without much rtxim for a technician 
to get to the inside. Sperry thought it was in the era of reusable parts and compo- 
nents. Wilt Lock points out that because of hiding individual components away, 
it was much more difficult to replace, say. a resistor that by itself might improve 
performance of the system. 1 ' If the circuit boards had had components that were 
easily accessible and replaceable, they would have been much more useful for 
exploring the unknown tcrritoiy surrounding the F-S conversion. Also, money 
could have been saved by using components from previous programs— a NASA 
tradcmaik. For instance, resistors from the decade-old Dy na-Soar program found 
their way into the F-8. Two larger component changes also occurred: the backup 
systems' integrators were changed from anak»g to single-function digital circuits 
due to excessive signal drift, and filters were added to reduce noise to the 
actuators/* 

While the team installed the two computer systems and tested them as 
diligently as the software, work went on with other parts of the aircraft. The 
sensor, and llight controls would provide inputs to the computer.; the outputs 
went to the actuators. All required a close connection with the original hardware. 

System Inputs: Sensors and Flight Controls 

It is reasonable to consider the pilot's flight controls and the sensors 

11 Wilton P. Lock. Willum R. FVicrwm. ami Guyton B. Whitman. "Mcctuni/jliooof and Experience with 
a Triptex Ely By-Wire Backup Comml Syncin' page. 41-72 mDturtptton and Flight Ten Rtsu lu of the 
NASA F-» Digital Fh-By-Wlie Control Syttem (WaihHgton. DC: NASA IN D-7843. I975t. pp. 42. 50. 

Lack interview. 25 March l«»S. 

Lock. Petouen. .ml Whitman. Triptex Ely By Wire Backup Comml System." p. 51. 
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together because they are both inputs to the system. In Phase I of the F-S 
project, the primary sensors were those provided by the Apollo inertial 
measurement unit. The other inputs came from the pilot, and the original 
arrangement of center-stick, rudder pedals, and trim switches was kept. An 
addition later in the flight research program was a side-stick. Side-sticks 
were already used on other research aircraft such as some lifting bodies, were 
being installed contemporaneously in a C- 141 and the 680J, and were 
destined for the YF-16 and the Space Shuttle. 

Basically, the stick and rudder pedals mechanically positioned slider 
valves in the hydraulic cylinders used as actuators at each control surface to 
deflect the surfaces and thus maneuver the airplane. A power-control cylinder 
moved the control surfaces relative to the slider valve positions. This system 
had no feedback to the pilot, so a set of springs, bobweights. etc., was 
arranged to give artificial "leer’ similar to that in a cable-only system. The 
stick would be returned to neutral once it was actuated and released. In the 
early days of fly-by-wire, engineers thought that such an artificial feel system 
would be unnecessary, probably reasoning that the electronic feedback would 
be sufficient for control. That was right, but pilots complained about the 
absence of sensory feedback from the controls. Aircraft like the CF- 105 
Arrow had to have a feel system installed before first flight. 15 The F-S also 
had a mechanical variable gain linkage that eliminated large pitch deflections 
caused by small stick movements. It is interesting that this had to be recap- 
tured in the form of "stick shaping” software when the mechanical linkage 
was removed. The official Navy aircraft handbook says that. "The feel forces 
arc kept low to make the aircraft pleasant to fly and easy to maneuver.” " F-S 
pilot comments contained in the individual flight reports agree that that 
objective was achieved in the fly-by-wire airplane as well. 

The original flight-control system also had automatic roll and yaw 
stabilization to improve general handling and gun platform characteristics. 
Loss of the stabilization system allowed the aircraft to still be controllable, 
but there were "drastic” reductions in maneuvering capability. The yaw 
damper, as with almost every jet since the B-47. and certainly on the CF-105. 
was the most unpleasant to lose. Immediate speed reduction and great care 
needed to be exercised in case of its failure. On this subject, the pilot’s 
operating handbook for the Arrow reads almost the same as that of the F-8. 
The yaw axis stabilization in the Canadian aircraft is a redundant system, and 
in emergency mode the yaw axis is the only effective damper.' 1 

To review, a pilot flying a conventional F-8 under visual flight rules 
would have data such as indicated airspeed, angle of attack, bank attitude. 

’ I. C. Floyd. •Hu Canadian Approach ui All- Weather lmertc|Xor Development ‘ Jamal o(i)u- Pinal 
iltnuautti irl Society, 62. No 576 1 Dee. I95SI: M5-866. 

* Nival Air Sytien* Command NATOPS Plight Manual. Nat? FJC and F $K. pp. I -27: 4 1 -V 
** PiWuiunan Pttoi'i Operating Inanutlaut Arran I iMalim. Onuiio: Avro Am rail limned. Apiil 
1958). pp. 22-23. 




etc., displayed on the instrument panel. He or she could see that information, 
combine it with the view out the canopy and some physical feeling of g 
forces, process it in the pilot computer (a human brain), and make decisions 
about what to do next. These decisions would be encapsulated in stick and 
pedal movements that caused a change in valve positions, hydraulics, and 
control surfaces, which were fed back to the pilot by the feel system. 

In the modified F-8. the visual cues would be present: so would the 
feedback: but nearly everything else changed. Once the pilot positioned the 
stick and rudder pedals, a completely electrical system took over. The inertial 
measurement unit was an arrangement of accelerometers and gyros that 
could track the attitude, velocity, ami position changes of the airplane without 
depending on external devices. It served to supply the flight-control com- 
puter w ith a reference that was compared to the pilot’s desires expressed in 
volts from transformers connected to stick and pedals. These linear variable 
differential transformers (LVDTs) were installed at the base of the stick for 
pitch and roll commands, but back in the tail for yaw. There were two in each 
axis, one for the primary, and one for the analog system. The computer 
(either the digital or each analog individually) would figure out control- 
surface position changes, and send commands on both a primary and monitor 
channel to the actuators, the end of the control chain. 

These changes were supposed to be transparent to the pilot: they would 
faithfully reproduce all of the good handling qualities of the F-8. indeed 
make them better. There was one glitch in achieving that objective, and the 
NASA team found that out in a roundabout way. From 17 to 21 May 1971. 

Q. W. (Jerry) Burner of Delco taught a class on the digital flight control 
system at the Flight Research Center. ; ' Ken S/alai recalled that everyone 
was impressed at the quality and volume of the documentation Delco pro- 
duced and in having a five-day class on it. He also remembers the consterna- 
tion caused by Burser’s mention of "the roll rate limit." For the first time. 
Center engineers discovered that the design of the Apollo inertial measure- 
ment unit would limit the F-8 to a maximum of a 70-degrccs-pcr-second roll 
rate as well as a 70-degree pitch attitude. This was somewhat less than 
fighter-plane capability but would not really affect the objectives of Phase I. 

The End of the Line: Actuators 

The conventional F-8 had two identical power-control systems. The 
conversion to fly-by-wire induced a change that replaced the slider valves in 
these with secondary actuators. Hydraulic Research and Manufacturing of 
California made them for the project in 1971. They each had primary and 

! * Phelps. personal log cumber 1. 28 Mar. 1971 lo 8 Apr. 1971 

" Sxalai mien «w. 12 lure 1998. A telephone conversation between 0» aln Decti of NASA and Allen 
Engle nl 0.1 per Labonnory on 27 May 197 1 ditcaue* lunha iimitMion* m the mil rate when gimhal 
angW rcelied a certain relationship, the nous lor thiv are in the Dydat llivtitteal Reference Collection 





A «•! of atflualofs is shown insisted beneaili lie big tiydraulc piston Ihai moved Ihe elevators 
on the F-a DFBW aircraft. (NASA photo EC67-7591). 


Rcfdt F. Kaunuvtm. Tri-Tec A.\tncitfo. Icncr to Charlci L. SencoftL Honeywell Inc.. “F- 
CVihuiion ol phase I.” 6 June 1974. 


The secondary aclualors were the last new components installed in 
converting the F-8 to digital fly-by-wire. Phelps tried to upgrade the engine 
from a J57 P20A to the more powerful P420. but that would have to wait for 
later. The P20A in the aircraft was sent out to the Navy for refurbishment. It 
relumed in October of 1971. In the fall, the avionics pallet and some other 
units were installed, and the software continued to be tested. In February. 
1972. Phelps' team reattached the wing panels and received the core ropes 
with the flight version of the software. The new backup flight system came 
from Sperry in early March, and Dclco visited to test the Apollo electronics 
and clear up minor problems with the inertial measurement unit. Later in the 
month, mechanical devices caused some difficulties: a burst hydraulic tube, 
an ill-fitting canopy, and fuel leaks. The engine, pilot’s scat, and tail were re- 
installed in April. 


backup modes. In the primary mode the digital computer sent analog position 
signals for a single actuation cylinder. The cylinder was controlled by a dual, 
self-monitoring servovalve. One valve actually controlled the servo and the 
other was a model for comparison. If the position values differed by a pre- 
determined amount, the backup was engaged. In the backup mode, three 
scrvocylindcrs were operated in a three-channel, force-summed arrangement. 
This meant that essentially the highest force value was used. " 


Ready to Fly 






Chapter Five: The Phase I Flight-Research Program: 
Digital Control Proven 


All the work preparing the aircraft ami software in Phase 1 of the digital fly- 
by-wirc program aimed at three objectives: to gain experience with a digital 
system, demonstrate dissimilar redundancy (especially licit synchronization is 
possible), and prove that a single version of the software can control an airplane 
reliably. 1 These objectives could be achieved early in the flight-research pro- 
gram. Knowing licit. Jarvis was well into planning and obtaining hardware for 
the later phases of the project by the end of 1971. when the Phase I software was 
pietty much done ami 802 's conversion was proceeding apace. In retrospect, this 
made the Phase I flight-research program seem almost a rehearsal for later, more 
complex experiments, especially because everyone knew single-string digital 
hardware was unacceptable for commercial use. Nevertheless, it was a valuable 
series of flights in itself. Aside from easily achieving the primary objectives, the 
test program showed the utility of various stability augmentation schemes, 
incorporated a sale-slick to try out the YF-16 flight -control design, and gave a 
half-dozen pilots fly-by-wire experience, including the chief test pilot for the YF- 
16. Fourteen of the 58 flight hours in 42 flights spread over 18 months from late 
May 1972 to late November 1973 evaluated the analog system or used it to 
support the YF-16. That was more than enough to convince later designers that 
switching back and forth to a backup was feasible. 

On the first of May 1972. Bruce Peterson, project engineer ami former 
research pilot. Issued the mission rules document that would initially provide the 
limits and emergency procedures for the F-8 flights. The rules included the 70- 



The digital fly by-wire aircral! caughl atxive a rare ctoud layer. (NASA photo ECN-3276). 


1 Calvin R Jim. An Overview ot NASA's Digital Fly-By-Wire Technology’ DevelofxneH Program.’ in 
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dcgrccvpci-sccond roll-rate limit due to the Apollo hardware restrictions. Also, 
the document specified a highly conservative crosswind limitation of 10 knots, 
less than half that of a conventionally controlled F-S. If pow er were lost to the 
inertial measurement unit, then the pilot would fly straight and level for two 
minutes to let the gyros sp*xil down so the unit could be realigned. The mission 
rules required most failure modes he handled by switching to the backup control 
system (BCS). These failure modes included: engine out. generator failure, 
battery voltage drop to 27 or below, and "any digital fly-by-wire abnormality" — 
the convenient catchall. Specific to the digital system, if the gimbal angles 
showed tumbling, or the computer or inertial measurement unit failure light was 
on for mote than a minute, the devices would be turned off. automatically 
downnuxling to the backup control system. Since the BCS was such an impor- 
tant safety item, its self-test had to he passed in all axes or a mission would be 
aborted. 

The mission rules (metaphorically) in one hand, the pilot had the Cooper- 
Harper rating scale in the other. This is how the pilots would tell the designers 
how well their product worked in each maneuver. Using the scale involved three 
decisions about the aircraft in a particular maneuver or flight phase: 


Is it controllable? 

Is adequate performance attainable with a tolerable pilot workload? 

Is it satisfactory without improvement? 

If the answer to the first question is "no." then improvement is mandatory, 
and the rating is 10 (the lowest). If the answer is “yes." then on to the second 
question, and so on. Ratings of 7 to l ) indicate ma jor deficiencies that require 
improvement. Ratings of 4 to 6 warrant improvement, but could be lived with. 
Ratings of 3 to I ranged from mildly unpleasant to highly desirable performance. 

Mission rules in place, pilot feedback scale adopted, hundreds of hours in 
the Iron Bird accomplished. Gary Krier was raring to go. Each flight, the ground 
crew would prepare 802 before the pilot got in the cockpit. The airplane would 
be connected to a power cart and a ribbon cable to a tap: reader. The main 
software was in the core rope, hut all the data needed could not be stored in the 
permanent memory. A flight-test program needs flexibility, so putting everything 
in rope would be as bad as the Sperry analog components Wilt Lock straggled 
with. Therefore, before every flight, the KSTART software load would be put in 
the erasable memorv. 

w 

KSTART 

The Aptllo computer had only 2.0CK) words of erasable memory. These 
could be used by the software developers at the Right Research Center to 
specify data constants, indicate the storage kxation of data to be telemetered to 
the ground, and even store short programs. Up to 105 variables could be adjusted 



for each flight. Among them, for example, were the gains in each mode and each 
axis. Tbc pilot used three four-position switches on the mode control panel to 
select a particular gain. Position three was optimal, as well as anyone could tell 
before a flight. Number four was a higher gain: number, one and two selected a 
lower gain. Other data in the preflight software load would be parameter, to 
compensate for the vagaries the inertial navigation unit had in its new environ- 
ment. The team kept the data in engineering terms, such as samples instead of 
time, and individual parameters could be changed via the DSKY. There were 
also branch control addresses and parameters needed tor the software to jump 
from one place to another in the permanent memory’. The downhst segment of 
KSTART simply listed the addresses of information needed to record and 
monitor the flight data on the ground, thus the major part of the telemetry stream. 
As flights progressed, there were eventually added three executable programs in 
the erasable memory: EMP-001 Restart Downmoding to BCS, EMP-004 
Parabolic Stick Shaping, and EM P-007 Single Pulse Pedal Deadband.' These 
programs were in response to handling problems discovered in flight rcseareh. 

The Flight Research Center developed the KSTART tape, hut Fcllcman’s 
group at the Draper Laboratory wrote and verified the Erasable Memory Pro- 
grams. The software engineers at the Center would then integrate it. Jarvis wrote 
a set of strict software revision and preparation procedures for KSTART.' There 
were two diagnostic programs that helped verify the validity of the KSTART 
software and tape. One was called DOWNDIAG. built by Ken Szalai and Daniel 
Dominik. another engineer. The other was SHERLOCK, built by Szalai and his 
colleague Richard Maine. DOWNDIAG checked the downlink list for errors: 
then the list would be integrated with the constants and values and the program 
to form a complete tape. The entire mission load. still on punched cards at this 
point, would be submitted with SHERLOCK to an IBM .160 mainframe com- 
puter. SHERLOCK checked for accuracy and valid value ranges. The output 
from SHERLOCK listed major and minor errors. Majors w ere defects like 
invalid loading sequences, incorrect formats, unreasonable data, and number 
base conversion errors from octal to decimal (as required by certain hardware). 
Their presence prevented a flight load from being punched. Flight Research 
Center engineer James B. Craft wrote a program that punched the verified deck 
using a small Honeywell Alert computer. The output deck was duplicated and 
sent to the Iron Bird and MIT for checks on simulators. 

Jarvis defined the mission nilcs for KSTART: 

1 . Downlink lists must have passed DOWNDIAG without error. Any 
changes to the list caused the deck to be resubmitted. 

2 . SHERLOCK must have passed without error, or with signed-off 
deviations. 


1 Refen R Bnimifather. "Man. Rated flight Soli sure tc* lie F-8 DFBW Program’ in itud . . p. 114. 
’ Calvin I avis, memo m KSTART proceitarei. Diyden Huivwal Reference Cnlleciiim 
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3. No Hight decks could be nude from changed decks that had not 
passed SHERLOCK. 

4. Each KSTART tape was functionally verified in the Iron Bird. 

5. A checksum verification called UPSUM using the DSKY was the only 
pre-flight erasable memory test allowed once the tape was verified. 

6. UPSUM was verified by visual inspection of DSKY output. 

7. A KSTART change summary was distributed to key engineers and the 

8. A KSTART progress checklist was the only necessary documentation. 

9. Any changes to non-Center-dcvelopcd areas must have been 
approved by Draper Lab. 

Once verified in the simulators. KSTART was recorded on Mylar tape for 
final loading onto the computer. An engineer would kxik for the correct UPSUM 
value on the DSKY. and then start the flight control program if it checked out. 
The gun bay access door would be ck>scd. and 802 was ready for the pilot to 
complete pie-taxi checks. 

The Pilot Checklist in the Digital Era 

The especially prepared pic-llight checklist had two additional sections 
added due to the Apollo computer and its associated hardware. One section listed 
the mission rales restricting the flight envelope as a reference. The other was 
specific to the flight-control system. Before taxi, the servos in all three axes were 
tested and engaged, using switches on the cockpit control panel to the pilot's left, 
behind the throttle lever. The computer checkout procedure was to select direct 
mode, then press the computer fail switch to test the warning lights. Following 
that, the pilot actuated the paddle switch to go to the backup flight system. Alter 
checking these basic modes, he (all the F-8 test pilots were male) tested SAS and 
CAS (control aaugmentation system). The next step was to cycle the controls to 
full deflection, check the servos, then do the hattcry tests for berth the primary 
ami backup computer systems by turning off the generator. Finally, the pilot 
turned the generator back on and reset the servos. These procedures exercised 
the critical components of the flight control system that simply had to be perfect 
before takeoff. 

Early Phase I Flights: Expanding the Envelope 4 

Brace Peterson assigned roles for the control center crew before the first 

1 Thr following acccunt i< llic Pha.se I flight ten* it pnnunly based on flight report* written lor each ten 
and looted a Dtyden Plight Research Center Itcn are not complete in themselves. They «e suppk- 
mcmcil by the prrsoeul ootet .0.1 interview! ot Calvin Jarvis. Wilton Lock. Jam:* Phclp* anil Kenneth 
Saalai. meets ww * with Gary Knei. anil the personal duty of Ronald J. ' Joe" Wilson. Prom these various 
source*. I assembled a narrative relating to each ot the 4 1 flights, fish flight description i* deriv cd tram a 
tollciticfl ot infcematinn from different sources. 




Ilighl. He would he the controller, the only person allowed to speak to the pilot. 
Project manager Cal Jarvis would keep an event log. Dwain DeeLs. Ken S/alai. 
Wilt Lock. and Jim Craft would monitor the telemetry. Team members Bill 
Petersen and Jim Phelps were responsible for aircraft systems. Center engineer 
Bruce Richardson made sure the instrumentation worked. 

At 08: 14:34 on 25 May 1972. Kricr rotated the F-8C nose up and departed 
Runway 04 at Edwards Air Force Base. By 09:02:32. when his main wheels 
touched down on lakcbcd runway 1 8. he had achieved the chief objective of the 
Phase I test program: digitally controlled night. He made two more flights in 
June: on all three he was limited to using the direct mode while engaged in the 
digital system. The flight on 8 June was general "envelope expansion" and a test 
of the backup sy stem. A flight scheduled for the 1 6 th slipped three days due to a 
BCS component failure that caused the preflight to be started again. This was the 
fust supersonic flight, and there was some porpoising at 0.98 Mach. Kricr did 
not notice any problems with quantization (delays in executing commands 
caused by the sampling rate) or any tendencies for pilot-induced oscillations on 
the first flight, but these began to crop up as the aireraft flew higher and faster. 
Between flights, he and the other pilots to follow would practice the mission 
profile in the Iron Bird for rehearsal and to look for glitches that could be 
repaired before flight. 

The first flight attempt planned for the SAS was to be on 3 August, but 
frustrating glitches caused it to be pushed back until the 18*. Draper Laboratory 
prepared EMP-004 after the third flight to provide parabolic stick shaping, which 
meant that some of the handling qualities would be improved, especially in 
pitch. Jim Craft loaded the new KSTART tape on 2 August for the D8K Y 
prcflight. The checkout showed that new parameters for EMP-004 caused 
deviations in previous values for deflection of the control surfaces that were so 
great they required sign-off by the senior engineers. This done. 802 coukl fly on 
the 4 h . When Kricr stalled his takeoff roll, he immediately had an electrical 
power failure and had to aboil. He cleared the runway and shut down. After 
towing the aireraft to the ramp, the ground crew opened the access hatch to the 
generator. There was lubrication oil pooled in the gear housing. To get the oil 
level correct, the crew removed significant amounts. Also, the cooling fan did 
not operate. The aircraft had its engine running for nearly an hour before taxiing 
out. The combination of texi much till, no cooling, and a long pre-flight killed the 
generator. The ground crew replaced it and the fan over the next several days. 
That gave the software engineers time to recheck the DSKY pre-flight on 9 
August. This time the results were worse. An “increasingly noticeable aileron 
oscillation" in both ailerons caused the engineers to terminate the pre-flight. 

By the 18*'. the project team had done enough fixes to proceed with the 
flight. When Krier taxied out to the runway. he called Bruce Peterson on the 
radio saying. “I have some good news ami some bail news. The good news first: 
the digital system and the electrical system arc OK." Peterson asked. “What's the 




The mode control panel mounted on the top center of the front instrument panel <*tiere me 
gjnsighl used to be was the most frequently used interface with the Might computers. Pitots 
could select different modes h earfi axis with the push buttons and manage the gains with the 
rotary switches. The panel also had warring tglits to indicate computer, cower, or inertial 
measurement unit failures. (NASA photo E-24742|. 

bad news'?"’ Kncr replied. "1 have a Hal lire.” Normally, this would not be much 
of a problem, but the Hying schedule was light that day. w ith the F-S flight 
sandw iched between two F- 1 1 1 tests. The ground team had to do a tire change as 
fast as an Indy 500 pit crew to get sufficient flight time. Pilots for a Convair CV- 
990 down from NASA’s Ames Research Center who were following the day’s 
tests on the radio heard the exchange between Kncr and Peterson. Sensing a 
chance to sneak into the schedule, they fired up their engines and sent their 
telemetry team to storm the ground control center. The defending F-S telemetry 
team refused to give up their places over a cut lire. Kricr called to the 990 pilots 
as he taxied by. "You could at least wait until the corpse is dead!” 

The SAS flight did go successfully that day. Kricr reported pitch handling 
much improved, and in roll, setting up stable bank angles was much easier. Only 
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four days later he was in the cockpit again for a slightly more ambitious test of 
the SAS and new stick gearing gains. Szalai issued a flight readiness report dated 
22 August 1972 that defined the differences from the prev ious version of 
KSTART so everyone would know the situation with the fixes. Takeoff was with 
the SAS engaged at the low-gain setting of 1 in each axis. Kricr reported a 
smoother ride at takeoff than in direct mode. His chase pilot in an F-104 reported 
turbulence on climb-out (they were Hying in mid-afternoon, when the heat of the 
day boils the air at low altitudes). The F-S handled the turbulence with aplomb. 
Level at 20.000 feet and flying at 300 knots. Kricr tried SAS in all axes at 
different gain settings. Stability increased as the gains increased, with yaw ami 
pitch damping best at a setting of 3. Alter some turns, he tried the pitch CAS in 
all gains. Attempting formation flight back in SAS mode. Kricr gave the F-S a 
Cooper-Harper rating of 5 due to considerable attention needed in the roll axis. A 
pilot induced oscillation (PIO) started in roll and had to be stopped. He tried to 
increase speed to -KM) knots, but it proved to be too fast for the system as it was 
configured. All axes became tix) sensitive, so Kricr eased off to 350 knots. After 
a few more tests, he set up for a landing tin lakcbcd runway 33 instead tif the 
concrete runway due to wind gusts from the north. He set 802 down safely 
despite sudden jumps and drops in the airspeed, and with the ailerons and rudder 
full-over to overcome the crosswind. In his report. Kricr said the touchdown 
ttxik place in considerable side drill and under "marginal control." Privately, he 
said he was essentially out of control when the w heels reached the mnway. 

Between this (light with its harrowing ending and the next, there was a 
special Open House at the Right Research Center in (somewhat early) celebra- 
tion of the 25* anniversary of the XS-l‘s breaking the sound harrier on 14 
October 1947. The F-8 was on display for the entire weekend of 8-9 September. 
After Phelps' team towed the airplane back to the hangar, they discovered "Curt" 
scratched on the right rear fuselage! Jim Phelps reported that the airplane crew 
left the graffiti as a reminder to be very vigilant when a one-of-a-kind rcscareh 
aircraft is on public display/ 

More important rcpiirs were in progress on the formation Hying problems. 
On the 15’ 1 . Kricr tried out partnering again with an F-104. The roll axis re- 
mained troublesome. There was a noticeable lag between stick movement and 
aircraft movement. A preliminary analysis attached to the flight report said that 
there was a delay of 280 milliseconds. The delay time attributed to the digital 
system was 105 milliseconds. Trying to figure out what else was contributing to 
the problem was hampered by the fact that the measurement instrumentation had 
a sampling rate larger than the digital flight-control system’s quantization, so 
intermediate data was being lost. 

NASA flight 44 of 802 was the fust by a pilot other than Kner. Thomas 
MeMurtry. the chief pilot on the Supercritical Wing project, which used another 
modified F-8. flew on 21 September 1972. He was accustomed to using the 

' lame* Phelps. review note* on On manuscript of this hoe*. Oil IS* 18 . 
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nose-wheel steering to keep the airplane centered on the runway on takeoff, 
switching to rudder control at about 60 knots. He tried to do the same with 802. 
hut when he switched to the rudder he found it much less responsive than tin the 
Supercritical Wing aircraft. Distracted by having to make large rudder inputs. 
McMurtry did not achieve a smooth rotation. When the airplane left the ground, 
he found himself in a lateral PIO. He stopped it. but it returned and had to be 
stopped again. As a result he rated both takeoff and climbout worse than the 
basic F-S. After exercising the control system at altitude. McMurtry returned for 
a landing with no wind. However, there was some convective heating close to 
the ground, causing the wings to suddenly dip or rise. Compensating too rapidly 
for tins took McMurtry close to another lateral PIO. As he approached the 
runway. Ik* tried very hard to keep the wings level, setting him up for another 
PIO. Why did McMurtry have different PIO problems than Krier? As accom- 
plished aeronautical engineer Duane McRuer has pointed out. there has never 
been a fly-by-wire system that (lew without pilots experiencing PIOs in early 
tests.' 1 Also. McMurtry had much less time in the Iron Bird. His thorough 
familiarization course included six hours of class time devoted to the hardware, 
control laws, normal and abnormal operation, and 27 hours in the simulator, 
compared to Kricr's involvement in the program from the beginning and over 
200 hours in the simulator. The engineers still found out that the handling 
characteristics had to be improved for pilots to step into a fly-by-wire aircraft as 
comfortably as they did moving among conventionally controlled ones. 

The next six flights were all evaluations of handling in SAS. CAS, and BCS 
modes. Gary Krier flew one in October and one in early November, then two in 
December. Tom McMurtry piloted one flight in early December and the first 
flight of 1973 on the 10*' of January. Problems in both October and November 
reduced the flight frequency. In October, the team grounded 802 due to the 
backup system's failing its self-test and also some troubles with one axis. Alter 
the early November flight, there was a fuel leak. 

On 30 January. Krier flew a mission in the F-8 Digital Fly-By-Wire aircraft 
to compare its performance with that of the F-8 Supercritical Wing. Once the 
two aircraft were in formation, engineers measured fuel flow, exhaust gas 
temperature, ami engine revolutions per minute (RPMs) on the fly-by-wire air- 
craft while at Mach 0.9 and four intermediate steps up to Mach 1.005. Krier then 
performed a few ground controlled approaches (GCAs) down to 200 feet when 
he returned to Edwards. These arc more commonly available at military airfields 
than civilian, and they require an experienced radar operator. An airplane with no 
precision approach equipment on board can achieve a precision approach by 
having the GCA controller call maneuvers based on radar-derived height and 
distance information. These arc rarely flown to altitudes lower than 200 feet— if 
a pilot can not sec the mnway at that height, it is best to break off the landing and 
fly elsewhere. Typical commands arc ‘‘three degrees left," and ”100 feet low.” 
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GCAs arc good for checking out an airplane's ability to remain stable at low 
speeds with frequent small maneuvers. The F-8 DFBW handled them well. 

The only flight in Febmary aborted due to an error in loading the KSTART 
tape that caused an infinite loop— the software was stuck repeating the same few 
instructions over and over and could not progress. It turned out that one item was 
not entered before starting the load. This flight began a series of tests of what 
happens when control surfaces moved more violently than normal, such as in 
dogfight maneuvers, and also of tracking stability using a gunsight Bruce 
Peterson got from a Marine A-4. 1 The three flights in March all had these 
objectives. 

On 6 April 1973. MeMurtry and Kricr flew a two- flight sequence that 
revealed anomalies in the digital flight -control system. It took nearly three weeks 
for engineers to complete the analysis that explained what happened and why. 
The first problem was an aileron offset. After landing and reaching the NASA 



The F-8 DFBW lead; Ihe F-8 Supercritical Wing in kxmaiion Tying exercoes in late January 
1973. {NASA photo ECN-3495). 


ramp. MeMurtry started the shutdown prcxcdurcs that would end flight 56. He 
used a modified checklist that left the primary computer running for the follow- 
ing flight. When he switched off the telemetry master switch, the ailerons moved 
to an asymmetrical positron that would cause a roll in flight. The crew chief 
asked MeMurtry to cycle the stick, and the control system continuously gcncr- 
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utcd a hard left roll signal. Ken S/ulai and his software team wcnl lo work. First 
Szalai found out exactly what MeMurtry had done in the cockpit. Then the team 
tried to replicate the failure in the airplane in a controlled environment on the 
ground with all the data recorders miming. It took two days, but they were 
finally successful on 10 April. Even then, it only happened once during several 
on/off cycles of the telemetry master switch. When the ailerons offset. S/alai's 
team dumped the erasable memory. With the printout and the telemetry data, 
they spent a week doing analysis. On 16 April, a taxi test confirmed their 
suspicions. The telemetry master sw itch had little to do w ith the problem. The 
answer lav m software. 

There was a Roll Rate Command (RRCl mode in the system that limited mil 
rates. On flight 56. an integrator was disabled in the RRC logic. This simplified 
the RRC mode to be a mil rate damper for that flight. When the integrator was m 
place, the software checked for output outside pre-set limits and subtracted the 
excess from the integrator output. The integrator bias remained even after the 
stick was moved to neutral. Since the integrator was disabled, the output was 
equal to the integrator bias, and the aileron offset was the result. The pilot moved 
the stick right or left, moving one ailemn up and the other down. When he 
returned the stick to neutral, the ailerons remained where they were instead of 
returning to neutral. Thus, the limiting logic should not have been used with the 
integrator oft". A change to the KSTART tape setting a constant to zero effec- 
tively eliminated the limiting logic. Still, the team did not know the cause but felt 
it was safe to fly. 

Apparently the engineers believed this without doing the testing, since Gary 
Kner made flight 57 three hours alter the aileron offset showed up on 56. The 
ground crew noted a roll rate drift in the backup mode prior to takeoff but 
allowed Kner to fly anyway. Everything was all right until three seconds before 
touchdown, when the RRC nxide suddenly switched to direct. Krier had to make 
a lot more slick inputs in direct mode, exacerbated by 35-knot winds. These 
rapid inputs reduced the hydraulic pressure in both power-control channels so 
much the entire system downmoded to the BCS as the wheels touched the 
runway. James Craft was assigned to analyze this downmoding problem. He was 
able to replicate the low hydraulic pressure and suggested a simple fix of either 
increasing the hydraulic pump capacity or keeping engine RPMs higher on 
appnxich. 

Krier flew all three flights in May. These primarily tested stability and 
control using mil steps and rudder pulses with some pitch evaluation m different 
gain settings. There were more low -speed handling tests using giound -controlled 
approaches. Aircraft X02's 60* flight as a NASA plane-23* of the digital fly- 
by-wire program —ended the first year of tests in late May of 1973. 

Back in early March. Phelps had heard that there would be only seven to 
lime more flights in the program. At that time. Jarvis planned to have an all- 
digital Phase II with three or four computers in the primary system. As an 
inteimediate step, there would be a Phase IB using only two primary computers. 



This was still not enough for commercial use. as a failure would initially cause 
confusion over which machine had failed, hut solving that problem would be 
interesting and a step forward Jarvis projected the first flight of Phase IB in 
December 1974. Fcllcman and some associates came out from Draper Labora- 
tory on 28 February and 1 March 1973 for Phase II planning sessions. They 
projected software development lor Phase IB would have to begin immediately 
to make the 1974 date. Over the next month the initial software specification for 
Phase II airivcd at MIT. Phase IB then more or less disappeared because Jarvis 
decided to go directly to Phase II. (This decision is discussed more completely in 
Chapter Six.) 

Early in April, he authorized the purohasc of a sale-slick for S4.000 and the 
training of four additional pilots in July. The YF-16 program decided to use an 
analog fly-by-wire system and wanted to use a side-stick. Gaiy Krier and Bruce 
Peterson flew to Forth Worth at General Dynama's' invitation to tiy out the new 
flight-control system for the YF-16 in a simulator They gave their professional 
evaluation at the plant. As they got into their T-38 for the (light back to Edwards, 
the F-16 project pilot escorting them asked for an informal evaluation. They told 
him that the system had real problems. General Dynamics asked the NASA 
program to try out the side-stick to see if it was a gtxxl decision, and to let some 
of the future YF-16 pilots fly w ith it. 

In the meantime, there were seven flights of the F-8 DFBW in June and July 
to meticulously exercise different combinations of gearing gains at both low and 
high speeds. Continued fixes for minor discrepancies held up the use of other 
pilots. This was fortunate, because it was better to have an experienced pilot like 
McMurtiy on board when a power-control hydraulic tube burst, causing an 
emergency landing. The tube was supposed to be .065 inches thick, but some- 
how there was a .035-inch tube. In the meantime, the side-stick arrived and 802 
did not fly for two months while it was installed. 

Flights with the Side-stick 

There were experiments with side-sticks in other fly-by-wire programs.* 

The ma jor advantages of a side-stick were eliminating an obstruction to seeing 
the instrument panel and making it easier to design a reclined seat for better g- 
tolcrancc. There is never an abundance of real estate in a fighter cockpit, where 
instruments and switches are jammed together and mounted at least down to the 
pilot's knees. As the amount of av ionics increased, this could only get worse. 
Hence, the invention of multifunction display screens that collected data to- 
gether. These, with small print and large amounts of information compressed on 
screens, must he seen more clearly than analog instruments. Getting the stick out 
of the way would allow easy views of all the forward-mounted instruments and 
place both the pilot's hands near to the side-mounted switches. Also, there would 
1 See. e.g . R. Dale Real uilh IXulco: 1-i.tcr. 117/tf/r.u Flit hi: /». I. itlm/ Syr. iWJ.Iimvt-in. IX 
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The side- slick was mounted on the riglit instrument panel. Note the clear plexiglass armrest that 
couH be toUed up tor stowage. The pilot could still read the instilments under it by lifting his 
aim a little and looking through the lianspaient material. (NASA pOolo E- 26466). 


be symmetry in the cockpit. The pilot would have the control stick in his right 
hand, throttle in his left, both festooned with switches and buttons. In combat, 
the pilot would sit reclined, both hands able to toggle all needed functions, 
looking out the window with a head-up display showing critical air data. 


A side-stick could he installed much more simply with a fly-by-wire control 
system than with a mechanical system. There were two schools of thought on 
which type to install. The fust type was a force-sensing side-stick. The pilot, 
wanting to climb, pulled back on the stick, like a conventional one. but it did not 
move. Instead, force sensors would translate the pressure applied by the pilot 
into a voltage. This signal would then he transmitted to the computer. This type 
of side-stick often caused the “Popeyc" effect on the pilots. Like the cartoon 
character Popeyc the Sailor Man. they experienced their forearm growing larger 
as they subconsciously did isometrics with the stick in violent maneuvering. The 
other type was a displacement stick. This side-stick did move, but not much. The 
pikH would get some feel, hut the distances it could be moved would not be 
more than one-eighth to onc-quartcr inch in any direction. The side-stick chosen 
for the YF- 16 was of the displacement type. 

The F-8 installation put the side-stick on the right side of the cockpit, and 
connected it to the analog BCS only, meaning that Will Lock would have 
primary responsibility to make it work. Jim Phelps worked with Gary Kricr on 
stick placement and an arm rest. Kner requested that the grip be mounted ncariy 
vertically, instead of at the forw ard angle used in other installations. The arm rest 
could he folded away so the range of motion of the pilot's arm would not be 
inhibited when using the center stick, as well as to uncover some switches on the 
right side instrument panel. On 13 August 1973 the side-stick installation began, 
and it ended on the 28". By 19 September. Kner and the aircraft were ready. 




Pete ison added to the mission rules ikK'ument tor the first side-stick (light. 
He had goals of safety and fidelity to the YF-16. Takeoff and landing would he 
with the center slick, as the floor for side-stick operations was 5.000 feet. There 
was a 4-g limit on maneuvers. The control in both pitch and roll in the YF-16 
was proportional: hence, it was like an undamped F-8. Consequently, the CAS or 
RRC mode could not be used. 

Taxiing to the runw ay the day of the flight. Kricr briefly engaged the BCS 
and enabled the side-stick. He tested the effect of taxi feedback and made some 
relatively sharp S-tums. The system felt normal, so he switched back to the 
primary system and the center stick. After takeoff and climb to 20.000 feet, he 
changed to backup mode and enabled the side-stick at 250 knots. There was the 
usual momentary transient when the BCS came on line, but no transient due to 
the sidc-stK'k. Kner rated his initial pitch and roll maneuvers with the new 
control as a 2 on the Ctxipcr-Harper scale. He noted that the adjustment to the 
side-stick was quite rapid and that it behaved better in the roll axis than indicated 
by work in the Inin Bird. 1 Increasing air speed thmugh 275 to .100 knots. Kncr 
found that the stick became more sensitive at higher speeds. He tried out various 
common maneuvers for the next hour: instrument Hying, approaches (to an 
offset of the ground at 1 5.0CK) feet), turns, missed approaches, and so forth. All 
rated 2s except the pitch and heading contml was a 1 and only holding a 2-g 
turn rated a 3. Kncr felt that mil acceleration using the side-stick was actually 
better than using the center stick in the BCS mode. He reported no forearm 
fatigue alter the one hour flight. 

Items added to flight rules for the next flight on 25 September 1973 included 
one that required the yaw SAS mode to be selected for any side-stick landings or 
takeoffs and another that set the wind limits at 10 knots down the mnway and at 
5 knots of crosswind. That opened the envelope to those critical maneuvers. 
Toward the end of the flight. Kner did a couple low approaches over the runway 
and was satisfied enough to land w ith the side-stick. On 3 October the flight plan 
called for a side-stick take off and also a landing if the w ind was calm. Kricr 
uxik off successfully with the side-stick enabled and did some GCA approaches. 
The same day Tom McMurtry got his first chance to fly with the side-stick 
controller. Penciled in at the end of the typed mission rules for that flight was a 
rcstnclion that if then: were a servo that could not be reset or if its circuit breaker 
tripped more than once, then the aircraft was to return and land in digital mode. 
Obviously, something related to the servos had come up. The procedure was 
gone from the mission rules for the next flight, so a fix evidently was made. 
McMurtry got to do a side-stick takeoff on this flight, and the goals continued to 
be exercising the BCS'sidc-stick combination. He also flew the final side-stick 
evaluation flight on 17 October. In six flights, three by each pilot. NASA proved 
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ihc YF- 16 control scheme workable, ami it was mcoiporatcd into the new 
aircraft. 

Pilot Familiarizations 

From 24 October to 27 November 1973. four new pilots Hew the final six 
(lights of Phase I of the F-8 digital fly-by-wire program. By that time, almost all 
anomalies or inconsistencies were purged from the system, so a pilot relatively 
unfamiliar with it could use it successfully on the first (light. On the 24 October 
mission. Phillip Oestnchcr. General Dynamics' chief test pilot of the YF- 1 6. took 
two rides in NASA 802. He hail nothing hut praise for live flight-control system 
and the NASA team, whom he called a '"bunch of real pros." On his first (light, 
he used the digital system for takeoff and for most of the time in the air. 
Ocstnchcr's ratings for nearly all maneuvers were I or 2s. He felt the airplane 
handled better than the conventional F-8. He used the side-stick toward the end 
of the morning flight, and landed with it. After a turnaround of only two and one- 
quarter hours (Ocstricher said his Reserve unit would take four hours), he was 
rolling on a side-stick takcolf. Oestnchcr devoted the entire mission to side-stick 
checkout. During the debriefing, he emphasized the comfort of the side-stick in 
the F-8. w ith its slight cant. The YF-16's stick had to be more vertical because 
there would not have been enough room for the pilot’s thumb if it hail been 
canted. 

A few months later. Oestnchcr was the pilot of the unscheduled first (light of 
the YF- 16. The flight test program for that aircraft was to begin in February 
1974. On 20 January, he was doing a high speed taxi test at Edwards when 
suddenly the airplane rolled and the wing dragged on the ground. Instead of 
reducing power and running off the runway, possibly damaging the aircraft, he 
added power and overcame some sickening pitch and mil oscillations. After 
keeping close to the runway on a go-around. lie landed without incident. Those 
who saw this performance praised his quick reflexes and outstanding flying 
ability. However, perhaps his previous takeoffs and flights m a fly-by-wire 
airplane with a side-stick helped a little as well. 

On 31 October and 8 November 1973 the former X-15 pilot. William H. 
Dana, got his chance to try out the F-8. Einar Enevoldson flew on 19 November, 
and the Phase 1 program ended with astronaut Kenneth Mattingly’s familiariza- 
tion flight on 27 November. There were many more requests for rides, especially 
from the YF-17 program pilots, but a project decision ceased familiarization 
flights in favor of beginning the transition to Phase II. 10 

On to Phase II 

When NASA 802 returned to the hangar after the Phase 1 flights, there still 
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was an important area of concern regarding fly-by-wire: since it was an electrical 
system, what effect would a big spike like a lightning bolt have on it? General 
Electric won a contract to find out. The chief worry was that a lightning strike 
would cause electro-magnetic effects on all channels of a fly-by-wire system at 
once, thus eliminating the positive effects of redundancy. GE used a transient 
analysis technique developed at NASA’s Lewis Research Center. An electric 
transient of the same waveform as. hut a much lower amplitude than, a typical 
lightning strike was pumped into the body of the aircraft. Then the results were 
extrapolated up to lightning level. These strike tests showed that there would be 
some damage but that the system would never fail because of them." Thus 
assured. Jarvis' team continued Phase II planning. 

Two events during the research program helped die digital fly-by-wire team 
gain some visibility. On 16 November 1972. it received a NASA group achieve- 
ment award. Then the first week in March 1973. Gaiy Kricr appeared before the 
members of the House Committee on Science and Astronautics to tell them that 
fly-by-wirc laid proved viable and was worth future support to make it robust 
enough to attract the attention of commercial users. That was one goal of Phase 
II of the program, but. as with the YF-16. this valuable national asset would also 
be used to help out another high profile program: the Space Shuttle. 
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Chapter Six: Phase Shifting: Digital Redundancy and Space 
Shuttle Support 

Phase II of the F-8 Digital Fly-By-Wire program lasted for roughly 12 
years beginning in 1973. The basic objective of Phase I was verifying the 
feasibility of flight control using a digital computer. For Phase II. it was 
Bight control using multiple, lighter weight, production-quality digital 
computer, with adequate collective safety and reliability, i.c. a more practical 
digital flight-control configuration. Soon at least two other major objectives 
began to receive attention. The Langley Research Center proposed using the 
aircraft to test adaptive and analytic control laws (control laws that self- 
modify depending on conditions). So one objective for the multi-computer 
version of the F-8 became solving a key issue for future fly-by-wire aircraft: 
would control laws or redundancy management be the chief difficulty in 
design? 1 Another objective was support of the Space Shuttle flight-control 
system's development. A key NASA scientist involved in the design of that 
system was Dr. Kenneth Cox of the Manned Spacecraft Center (renamed the 
Lyndon B. Johnson Space Center in 1973). He hail alertly followed what was 
happening at the Flight Research Center ami kept Calvin Jarvis' team in- 
formed of. and as advisors to. decisions made about the Shuttle. The two 
programs eventually adopted the same processor, enabling the Shuttle to reap 
the rewards of a hardware shakedown whose value far exceeded the money it 
contributed to the F-8 project. Later, the F-8 program would help solve an 
embarrassing and dangerous pilot induced oscillation problem for the Shuttle 
program. After achieving the objectives of Phase II. the F-8 program moved 
into a Phase I1B which consisted of a series of experiments in sensor analytic 
redundancy, resident backup software, further work on remotely augmented 
vehicle studies by Langley, and other experiments. 



The Space Shuttle gained •nmediate benefits Irom NASA's By- by -wire research. Here Endeav- 
our returns trom space to the t>ydeo Right Research Center. (NASA photo EC92-05165-2 by 
Carla Thomas). 
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As noted above, the first version of the Phase 11 software specification 
was issued in early March 1973. before the final version of the Phase 1 
specification and almost nine months before the last Phase 1 flight.' Project 
manager Jarvis’ notes arc filled with Phase II procurement activities from 
1972 on. At the beginning, plans were to fly a multi-computer system by late 
1974. The actual first flight of Phase II was in late August 1976. two years 
and nine months after the last flight of Phase I. Why did it take so long? 
Largely, because it was almost a totally new system. There were new com- 
puter mounts, the removal of the KECO cooling system, new computers 
(both primary and backup), a new three-channel interface unit, a modified 
mode and gain panel, a computer interlace unit for the pilot, bigger pumps 
for the hydraulics, removal of the inertial system and its replacement by rate 
gyros and linear accelerometers (more typical of aircraft flight control 
instrumentation), inclusion of the side-stick as part of the primary system, 
more powerful actuators, a new generator, new fuel tanks, and an upgraded 
engine. This was only the hardware. There also was new software with 
pioneering redundancy management functions and software for ground 
control of the airplane in the Remotely Augmented Vehicle experiments, 
which meant even more hardware, such as a command receiver and dedi- 
cated dow nlink. Nearly everything inside the skin of the aircraft was 
changed, and the only external evidence of the modifications consisted of a 
new antenna and a tail-mounted video camera. These changes took time, and 
the new hardware was not always working perfectly when installed, necessi- 
tating rework. Ken S/.alai recalls that the software development took "longer 
than anticipated." a common problem even with today's new programs.' 
Furthermore, it took nearly a year to verify the original release and its 
updates. (The first flight of Phase II used Release 7A. Mod I. indicating 
many revisions). 4 S/alai remembers going outside for a break during yet 
another all-night debugging session and looking at the starry sky of the high 
desert to try to clear his head. There was a lot of overtime preparing for the 
Phase II flights. At first. Jarvis wanted to make a less ambitious transition to 
avoid some of the negative side effects of the “big bang" approach in which 
all the changes would come before first Right. 

The Short-Lived Phase IB 

Jarvis announced at a meeting on 16 February 1973 that there would be a 
Phase IB in which the current aircraft would have two primary computers 
installed. This would enable trying out computer synchronization on an 
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easier configuration than the three or more machines needed in Phase II. The 
first flight of this system was set for December of 1974. about a year after the 
last High! of Phase I and a year and nine months after the software specifica- 
tion arrived at the Charles Stark Draper Laboratory. He also said he would be 
going to Langley to discuss Phase II before the end of the month.' The two- 
computer system with the backup was quite safe, with complete system 
failure probabilities very low. on the order of one chance in a billion. 

Soon this version of Phase IB disappeared. Langley engineers opposed 
having more than one computer on the aircraft in the next phase since they 
favored the single-channel, high-reliability approach demonstrated by the 
Apollo space program. This was obviously unacceptable to the Flight Re- 
search Center, as it obviated the goal of testing multi-computer synchroniza- 
tion and redundancy management, which was fell to be a necessity for cost- 
effective aircraft flight-control applications. Pressure from NASA Headquar- 
ters to settle the issues in addition to funding constraints had caused Jarvis' 
team to propose the two-computer system as a compromise.'' Later, when the 
Space Shuttle program promised funding to support flight-controls develop- 
ment. Phase IB quietly went away, and a three-computer system became the 
basis for Phase II. 

Phase IB returned briefly in 1975 when General Electric contractors 
doing a new lightning study referred to a IB that consisted of a single one of 
the new computers installed in the Iron Bird.' Except for that reference, the 
numerology returned to a general designation of Phase 11. Peter Kur/hals 
from NASA Headquarters expressed an opinion that all two-computer 
experiments be dropped. Jarvis and Szalai concurred.’ Phase II later split into 
A and B sub-phases in which HA represented the general proof of the redun- 
dant multi-computer concept and the Shuttle support flights. Phase II B was a 
series of discrete experiments to extend the proven system. 

Finding an Airplane 

New computers would be an obvious part of the next stage of the pro- 
gram. Jarvis also wanted a new aircraft that would be more suited to the 
objective of demonstrating a multi-computer flight-control system to com- 
mercial aircraft manufacturers. Characteristics such as tw in engines or even 
the idea of using a small transport like the DC-9 were attractive. But the first 
airplane considered was a ‘’target of opportunity." In June 1972. Jarvis heard 
that the Air Force's F-4 fly-by-w ire project was cancelled. He wanted to meet 
with project manager James Morris and discuss incorporating it in the NASA 
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program as an option to Phase 1B. V The aircraft was at Edwards AFB for 
testing, and Gary Kricr got to fly it from the back scat in July (the Air Force 
version of the F-4 had controls in both cockpits, the Navy version only in the 
front cockpit). 1 " There was a restriction that no fly-by-wire takeoffs and 
landings would be done during the NASA courtesy flight, a capability 
retained with the original mechanical control system. On 19 July 1972 Jarvis 
met with F-4 (Project 6S0J) personnel to discuss aspects of a possible joint 
program. 1 1 However, the Air Force soon received more funding for the 
project, and the F-4 was made statically unstable by the addition of canards. 
It kept its analog-computer-based flight-control system and flew for several 
more years. 



The F-4 that the Av Force converted to an analog lly-by-nire system was considered for Phase II 
ol NASA's project. Mere furding for I he Ait Force aupeared. however, and the canards were 
added to make the airplane longitudinally unstable. (U.S. Ar Force photo). 


In late July 1972. Raymond Hood of Langley added to the list of candi- 
date aircraft a Lcarjet that Boeing would modify, a 737. T-39. and DC-9. 
Later in the summer the RB-66 and a new aircraft, the S-3A, were consid- 
ered. with Langley sending an engineer to check out the S-3. 1 ' All these 
aircraft were twin-engined. However, a transport category aircraft would 
require an FAA Supplementary Type Certificate. Documentation and testing 
to receive one would cost about S 1 .000.000. Just in case. James Phelps was 
asked to check on the availability of spares for the F-8. He found out that the 
reconnaissance F-8s would fly until 1980. the fleet and reserve H and J 
models until 1983." This was long enough for the planned closure of Phase 
II in late 1978. The project proceeded with the idea that the F-8 would fly 
early in Phase 11. and a converted Lockheed JetStar NASA already owned 

* Calvin Jarvis notebook number I). Jan. 197 1 June 1972. 

" Gary KrMt. telephone interview. 24 July 1998. 

" Colvin Jjivi.v. notebook rumbcrl. 19 July 1972. 

'••Jjrviv. notebook numbu 1.20 July. 22 Aug. .uul 22 Sept 1972. 

" Ptwlpv logbook lumber t 2(1 Feh 197.1. 
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would be modified to replace it later. The cost of the JetStar's modifications 
(including adding pilot safety devices like ejection scats) was estimated at 
three million dollars. In contrast, the F-X modifications would be S850.000. 1 * 
NASA ultimately decided to stay with the known aircraft and the lower cost 
for the entire program. 15 

Finding a Computer 

Choosing a computer for Phase II took nearly two years. The Flight 
Research Center. Draper Laboratory, and Langley worked closely on the 
decision. In December 1971. Philip Felleman of Draper visited w ith com- 
puter specifications. A NOVA computer with four thousand words of memory 
would cost $20,000. The Honeywell 601 with the same memory was attrac- 
tive at less than 30 pounds. The RCA 215 and Control Data Corporation 
Alpha were also on the list. The Alpha's price was $35,000 each for a lot of 
25 computers."’ All of these machines were relatively inexpensive and 
lightweight, but they were short of memory and overall processing power. 
The next group of more powerful computers included the Honeywell X0I 
“Alert." the Sperry IX19A. and Langley’s nomination, the General Electric 
CP-32A. These machines typically had larger memories of about sixteen 
thousand words, longer computer word sizes such as IX bits, and a steeper 
price tag in the $70,000 range per computer. 

In the meantime, the Shuttle program was trying to choose a machine as 
well. Its engineers had no experience base with aircraft control systems, as 
both the Gemini and Apollo vehicles were fly-by-wire but not designed to be 
very maneuverable in the atmosphere. So. they had to get information from 
aeronautical projects. As early as October 1971. Howard W. “Bill" Tindall 
wanted to bring the Shuttle llight-control designers out to California to see 
what they could learn from the F-X project. Tindall was the primary NASA 
liaison to Draper during the Apollo program. On 4 May 1972. John “Jack" 
Garman. a key NASA engineer on the Apollo flight controls and later a 
manager of Shuttle software development, called Ken S/alai. S/alai briefed 
Garman on failure analysis, software control. Bight software readiness, and 
mission rules for the F-X. Early in 1972. William McMahon of the Manned 
Spacecraft Center told Jarvis that the Shuttle program thought about buying 
the Sperry backup system. 1 * It was still searching for a suitable computer for 
the primary system. 

Draper Laboratory not only suggested computers, but also attributes that 
its engineers thought an aerospace machine should have. The software 

" Jjntet Phcl|M. logbook lumber 4. 25 Jan. 1974. 

"Jam* imcrvico. 19 Sep 1998. 
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" Jarvis, notebook numbe l>. IS Feb. 1972. 




engineers there wanted a machine that used floating-point arithmetic. The 
Apollo computer was a fixcd-dccimal-point machine. It represented real 
numbers with the decimal point always in the same location, so to have more 
value to the left or nght of the point meant hand-scaling the number— a 
difficult and error-prone process. Floating-point machines stored the value of 
the number and the location of its decimal point. Arithmetic is easier to 
program in floating-point, but it requires a larger computer word size and is 
not as accurate as fixed-point when the latter is done well. However, large 
word sizes meant more accuracy in general. 

Draper also wanted a high-level programming language for the software. 
This required a compiler that would take the source code of the program and 
translate it into the machine’s unique low-level code. These low-level '‘as- 
sembly" codes execute faster but arc much more difficult to write and 
maintain than those in higher level languages. The high-level languages like 
FORTRAN had been around for 15 years, and Fcllcman's group wanted to 
take advantage of them. Richard Parten. NASA’s Shuttle software develop- 
ment manager, authorized an experiment in which two teams of equal ability 
coded a function in both assembly language and a high-level language on the 
same computer. The high-level language code was slower and less compact, 
as expected, but in all aspects no more than 15 per cent less efficient than the 
assembly code. Parten authorized using high-level languages for the Shuttle, 
reasoning that the performance margin was tin* slim to make it worth the 
extra maintenance costs. The Manned Spacecraft Center had already consid- 
ered a language called HAL. It was an extension of FORTRAN that made it 
possible to do vector arithmetic and schedule real-time programs, among 
other good features. Draper wanted to use it as well. The software engineers 
would have to wait until the computer choice could be made to find out if a 
compiler for HAL would be available on that machine. 1 * 

In the meantime. Jarvis zeroed in on some computers already used in 
aircraft to run avionics other than flight controls. The Autonetics D-216. a 
1 6-bit-word. 16-thousand-word-memory machine was in the Rockwell B-l A 
and cost about SX5,000. Sl It quickly went out of consideration as machines 
with larger memories entered the contest. More memory would be needed to 
store the additional synchronization and redundancy management code for a 
triplex system, especially if a high-level language were chosen. 

On 5 October I ‘>72. Right Research Center and Langley Research 
Center engineers held a then-Phase IB coordination meeting at Langley. The 
team in Virginia found a new computer: the Singcr-Kcarfott SKC-2000. It 
had floating-point arithmetic, and the memory was 16 thousand words. 

" TV: newt about Dra|«* Laboritark'* ck^arcv n in a menu) bemccn Allot Engel t< the Laboratory ami 
Ken S/alai al if* 1 light Research Cette*. 10 Aug. 1972 (Dryden night Research Center Unices Office I. 
He vtcirv n! ihc chos'c otf HAL anl a description ol the Lneuage are in James E. Tmtuvko. Cimpuun lit 
Sp* WMr < Washington. DC: NASA CR- 1S2SIS. March 199K). pp. 109- 1 1(1 and Appendix I II. 

*lnvB nolcboc* iwnthcrU. 2.< Jure 1972. 




expandable to 24 thousand words.' 1 However, it would cost $185,000 in the 
larger configuration. The Plight Research Center w anted the Tclcdync 43 M, 
which would only he about $50,000. Since the Center wanted to buy three 
machines each for the Inin Bird and the F-8. plus a development machine or 
two for Draper and maybe a spare, the cost difference was roughly a half 
million dollars for Tclcdync computers versus nearly two million for Singer- 
Kcarfotts. Also, the SKC-2000s would be on an extended delivery schedule, 
while Tclcdync offered to loan a machine to Draper right away. The groups at 
the meeting decided to select the class of computer by 1 November, and the 
actual machine by 1 December.” 

After the Phase IB coordination meeting on 6 November 1972. Jarvis 
told Ken Cox in Houston and Dr. John Bird at Langley that Draper w ould set 
up meetings with both the Singcr-Kearfotl and Teledyne representatives to 
set final pricing and specifications. 1 * Almost simultaneously, the Shuttle 
program found the IBM AP- 101 computer and it had its first mention in 
Jarvis' notes on the 10" of November.-' 1 Ken S/alai's notes reveal that the 
IBM computer had a 32-thousand- word memory, consumed 370 watts of 
power, and weighed 47.7 pounds. In contrast, the TDY-43M was in two 
boxes of 35 pounds each, and the SKC-2000 drew 430 watts, and weighed 90 
pounds.-' By 28 November. Jim Phelps was studying the interface needed 
between the F-8 and AP- 101 . and whether it would be suitable for a quad- 
computer installation as well as for the proposed Control Configured Vehicle 
experiment that would add a canard to the aircraft. No external cooling 
would be needed for any of the three computers, but the IBM internal blow- 
ers were good to 50.000 feet while above 30.000 feet the Singer machine 
needed ram air from an intake that did not yet exist. Also, the IBM and 
Tclcdync computers could use the current power generator, but the SKC- 
2000 would need a new. larger one. Finally, the SKC machine was so big 
Phelps dicadcd the stuffing job necessary to fit multiple computers into the 
space allocated. If a canard were installed, its structural needs in the com- 
puter bay would make it impossible to use Singcr-Kcarfott’s computer/" 

On the last day of November 1972. IBM sent Vincent Obsilnik. Gib 
Vandling. and Edward Zola to the Flight Research Center to present the AP- 
101/' Even though all three computers were thoroughly discussed by year's 
end. the I December deadline for selection passed and nothing definite 
happened for several months. By the first of March 1973. at roughly the time 
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The AP-IOIs like those intended (<x fly-by-wire need an interlace unit. Here is one largely h^id- 
nade lor Ihe Iron Bird. Note the tripe redundancy. (NASA photo ECN-5067). 


Sulu. |«v.*ul note*. I Mar. 1973 


the initial version of the software specification went to Draper, the Flight 
Research Center set 1 2 March as the issue date for a formal request for 
proposals . Five weeks later the bids were due. with evaluation taking a 
couple months. The winner had to deliver the initial lot of five computers by 
September, four more by March 1974. one for the Iron Bird by 1 April 1974. 
and the first one to Langley by June 1974/' 

During the final competition, the major players in the Shuttle llight- 
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control system effort campaigned for the AP-101. Jarvis got a call from 
William Zimmerman of Intermetrics (developers of the HAL compiler) 
saying that if the Center chose the same computer as the Shuttle, the com- 
piler and support software it was developing would essentially be free. 
Garman's boss in Houston. James Satterfield, said that any software built for 
the Shuttle would be made available. John Miller of Intcrmctrics said that his 
company was suggesting changes to the AP-101 to make executing HAL 
more efficient and that these changes would be in the computer, delivered to 
the F-8 project since they were already being developed for the Shuttle.-' 

If the goal of Shuttle support were to be met. and. more importantly for 
the short term, if the Shuttle program would send $1 million to the Flight 
Research Center to augment joint program funding, the choice was clear. The 
engineers at the Manned Spacecraft Center essentially settled on the AP-101. 
even though it did not take actual delivery for a while. On 27 August 1973. 
IBM signed the contract to supply the computers to the fly-by -wire pro- 
gram. 1 " Vincent Megna. who led large portions of the Phase II software 
development at Draper, said that the final decision was NASA’s, even though 
the Laboratory was involved at every step.' 1 HAL was abandoned due to 
incompatibilities with the final Shuttle hardware arrangement and the diffi- 
culty of software conversion, but IBM did make significant changes to the 
AP-101, forced by poor design and construction.* 2 By taking the lead in the 
use of the computers, the Flight Research Center repaid the Shuttle program 
several times over by uncovering discrepancies that would have hurt the 
Space Transportation System’s development schedule. 

AP-101 Woes 

The overall hardware arrangement for the Phase II system was simpler 
conceptually, but more difficult to implement, than the Apollo system used in 
Phase I. The new pallet mounted three computers and a single three-channel 
interface unit. The computers delivered to the program could do both lloat- 
ing-point and fixed-point arithmetic. They could process 480,000 instructions 
per second, about sixty times faster than the IBM computer used on the 
Gemini spacecraft less than a decade earlier. The initial prediction was that 
the machines would have a 5,494-hour mean time between failures." It 
turned out that the actual figure was much lower, causing Phil Fclleman to 
remark later that fixing the AP-101 ranked as one of the major results of the 
program, equal to proving the concept of redundant systems." 
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The disappointments started soon after deliveries in 1974. The F-8 
program eventually received serial numbers one through nine of the AP-101. 
which, of course, were the most likely to fail. The bugs at first were fairly 
localized: all the floating-point features failed on number one. an instruction 
did not work on number two. and this was coupled with a 50 percent drop in 
the data transfer rate. 1 ' By the middle of 1975. failures became endemic. 
There were 19 faults in the first seven computers, yielding a 204-hour mean 
time between failures, less than five percent of the projection. At times only 
one computer was working. There was no pattern to the bugs apparent at that 
time. * 

Finally, the engineers found a common problem. The circuit boards, built 
in layers, had separated during use and caused no end of short circuits and 
other failures. It turned out that the manufacturers of the boards used a 
watered down coating fluid so it would be easier to spread on. It was so thin 
it seeped between layers and expanded when heated by the running com- 
puter.- 17 IBM rectified this and other manufacturing errors, but often the fixes 
were applied to a particular machine and not all. By late 1975. IBM delivered 
all computers, but the mini ificat ions were different, depending on the reliabil- 
ity. Here is Jarvis’ table from 16 October, where the higher the modification 
level, the more extensive the fixes:'* 


Serial Number 
1 
2 

3 

4 

5 

6 

7 

8 
9 


Modification Level 

4 
9 
7 
7 

5 
5 
5 
7 
9 


An indication of the effect on the program is that the first computer cost 
$87,000 and the last $130,000." As the first flight approached in late sum- 
mer of 1976. heat-related problems such as cracked ceramics and seals 
continued, so IBM sent John Christensen and Fred Hudson out to California 
to baby-sit the machines and provide faster service. The frequent failures 
slowed software development and verification. 

Ken Szalai described what was projected to happen and what actually 
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happened with (he AP- 101s during an m-hou.se seminar on redundancy 
management in 1979.*° The mcan-time-belwcen-failurcs record of (he AP- 
101s was expected to nsc to 1.000 hours at 10.000 hours of cumulative 
operation and stay level for a while. On delivery of the flight system, things 
were pretty much as expected: 675 hours between failures at 7.000 hours of 
use. But from February to July 1976. when operations reached 1.200 hours 
per month, the mean time between failures declined to 500 houis. Following 
final installation in the aircraft at 13.500 cumulative hours, the failure 
interval hit a low point of 375 hours in September 1976. It was only after 
major rework, which delayed the flight research program by four months, 
that it eventually recovered to 500 hours by 18.000 cumulative hours. By 
mid- 1978. the mean time between failures reached 750 hour, after 25.000 
hours of operation. At no time did the computers meet, let alone exceed. 
IBM's reliability projections. 

Software 

While the F-8 underwent extensive hardware modifications, the Draper 
Laboratory and Ken S/alai's software team at the Center solved the problem 
of how to mcchani/c a multicomputer system to act like a single computer 
for control laws and like three independent computers for fault tolerance. The 
Phase II software specification showed how much the F-8 program team 



Doing Ihe long hiatus between the Phase I wid Phase II lights ol the F-8 DFBW. Boeing 
responded to Use Air Force's cal Ic* a short-held la*eoIl-and-landing cargo plane with Ihe triple- 
redundant digitally controlled VC-1 a. Thus, it was Ihe Irst multi-computer digital ty-by-wre 
aircraft in the air. (Photo courtesy ol Boerig). 


“ Kenneth SuLu. "Reihulmk Muuecmcnl." il»,lc Irran in-hmm urnunar uric*. 29 June 1979. 
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learned from Phase I. Il was a different document in tone and content. There 
was a more narrative style and it contained suggestions about software 
development itself.* 1 The software would be scheduled to execute cycli- 
cally— a Draper Lab trademark— within a twenty-millisecond loop. This 
made the synchronization easier to accomplish. The computers would 
attempt to synchronize up to three times, sending each other discrete signals 
and sharing data, the attempts totaling no more than 200 microseconds. If a 
computer failed to keep in step, the others would ignore it and move on. A 
failed computer’s self-test software would probably detect the failure and 
restart it. In contrast. IBM programmed the primary Shuttle system of four 
computer, as an asynchronous, priority interrupt system.*’ This meant that 
the highest priority module of the software loaded in a particular mission 
phase would run until complete, then the next-highest priority module would 
run. and so on. To synchronize, each computer halted every time one of three 
actions occurred: an input, an output, or a change of module. The computers 
would exchange messages telling each other what they had just done. 
Miscomparisons or a failure to exchange information in four microseconds 
indicated a failure. This is a more complex method for synchronization. 

The software for Phase II was also larger than that for Phase I due to a 
need to handle new pilot interface devices. The modc-and-gain panel still had 
the direct (DIR), stability-augmentation (SAS), and control-augmentation 
modes (CAS), but added a maneuver- load-control button in CAS mode, 
which was the predictive augmentation in pitch, and expanded the four- 
position gain switches to five. There was also a digital autopilot with Mach- 
hold. altitude-hold, and heading-hold selections. Finally, the Phase II system 
allowed pilot access to the computer software from inside the cockpit 
through a Computer Interface Panel. This contained three seven-segment 
displays, two thumb wheels with numbers zero to nine, and "enter" and 
"clear" buttons. The pilots mostly used it to start pre-flight self-tests and to 
initiate the Remotely Augmented Vehicle mode, in which the aircraft's 
control laws would be resident on a ground-based computer and commands 
for the actuators sent up. 

Internally, the software used fixed-point arithmetic for sensor data and 
floating-point for the control laws. The memory layout of the software started 
w ith two thousand words of data: then the operating system and redundancy 
management comprised the next three thousand words. There were five 
thousand words for the control laws; sensor redundancy management took up 
about 2.500 words: preflight tests, about the same amount of space; and the 
ground display and program load instructions occupied the final four thou- 
sand words of space. This totaled 19.000 words of the initial buy of 24.000- 
word memories expandable to 32.000 words. 

1 Kenneth Sulii ami Joveph Gera. ~F-H Uijznal Ply. By- Wire Phate II SotiwMC Specification.' Revuion 
F. I Dee. 1975. 
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Draper Lab designed the 20-millisecond inner loop to begin with the 
master interrupt; then the synchronization, computer-redundancy manage- 
ment. scheduler, and input read look place in the first two milliseconds. The 
sensor signal selection occupied the next three milliseconds. The first control 
law execution took two milliseconds, followed by the outputs to the actuators 
and the displays. The second control law and signal selection came next, then 
data recording and the Computcr-Intcrfacc-Panel read. The remaining six or 
so milliseconds were devoted to self-tests. The signal-sclection-scnsor 
redundancy management worked this way: if there were three gcxid signals, 
the system would take the mid-value; with two good, it would take the 
average: one gcxid became the default." 

Early in 1976. the software matured to the point where the pilots could 
be in the loop for verification. Draper Lab intended Release 5 of the software 
to be the Right release and scheduled a (light qualification review on 22 June 
1976. However, it arrived stillborn at what was now officially the Hugh L. 
Dryden Right Research Center. There were frequent unexplained restarts. 
The qualification meeting was cancelled, and in the last week of June over 
2.500 power-up starts tested changes in the procedures designed to eliminate 
the problem. Release 6 arrived early in July configured as a (light tape. A 
pilot used it nght away and reported no anomalies. Draper Lab issued 
Release 7 by the end of July w ith the (light qualification meeting rescheduled 
for 10 August. 

The (light qualification meeting reviewed the test philosophy and respon- 
sibilities. Six engineers were on Szalai's verification team: Richard Larson, 
Sam R. Brown. Ronald "Joe” Wilson. Kevin Petersen. Richard Glover, and 
S/alai. They went over the tests they conducted, the results coming in 
graphical form and in a senes of one-page Software Verification Reports that 
chronicled the test objectives, set-up arrangements, results, and conclusions 
for each test. A year of seemingly endless work had finally paid off. The 
direct and stability-augmentation modes were ready for Right, but the 
control-augmentation mode and the autopilot needed more testing." These 
unfinished components were not needed on the first flight. 

The Computer Bypass System and New Actuators 

A lot of overtime went into obtaining and installing the revised analog 
backup system and upgraded secondary actuators. These were the domain of 
Wilton P. Lock. He wanted more powerful actuators for Phase II. The backup 
had a name change to the Computer Bypass System, and he also wanted 
better computers to match. 

" Kenneth Saalai. Phillip lellcman. an] Joseph Gera. "Design <e«l TeM ExperiefKC with a Triply 
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Il was though! that failures due to the new primary system might cause 
increased use of the backup, reason enough to obtain newer technology. 
Sperry offered a more up-to-date version of the original equipment for 
$355,000, or it could supply the same technology as used on the Air Force 
fly-by-wire program using the 68QJ F-4 aircraft. This system had only three 
avionics boxes instead of six. and would only cost another J45.000. 45 Lock 
chose it. 

The modifications of the actuators increased the power of the system. 
One change made the signals from the analog computers to be “force 
summed" when they reached the actuators, resulting in a quicker response. 4 ' 
The redesigned secondary actuators produced 20 percent more force due to 
an enlarged piston. The new actuators were also more reliable: Hydraulic 
Research modified the Phase 1 hydraulic actuators to provide a purer triple 
redundancy. In Phase I. there were only two hydraulic sources for the 
actuators. For Phase II. there were three, neatly matching up with the three 
primary and secondary computers. The secondary electric actuators had three 
channels, one dedicated to each computer in the primary system. 4 The 
actuators were also shared by the analog computer bypass system in the 
event of a total failure of the primary digital system— one that never subse- 
quently occurred in operation. These two subsystems completed the list of 
components needed for the new fly-by-wire package. 



The inply-reduiijanl Compute' Bypass System mounted in a tyjn bay ot Use F-8C. (NASA photo 
ECN-5223). 
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Preparing the F-8 for Right 


While the ensemble of fly-by-wire hardware and software was as- 
sembled. Jim Phelps's airplane-conversion team prepared the P-8 for installa- 
tion and did some modifications of its own. Jarvis held a system preliminary 
design review on IS and I 9 September 1973 that resulted in final approval of 
the cockpit panels, so they could be fabricated. At that time, the team ex- 
pected the software and Sperry's analog system modifications to be the 
pacing items, finished by late September 1974. The lightning tests, sneak- 
circuit analysis ( see below), computer deliveries. Iron Bird modifications, 
and failure analysis would all be complete by mid- 1974. Final qualification 
and first (light would be by late December 1974.“' As we have seen, com- 
puter hardware and software delays set the program back at least a year and a 
half, allowing a less hectic pace than the Phase 1 modifications on the aircraft 
itself. Nevertheless. Phelps was already looking at connector and gyro 
placement for Phase II while the Phase 1 (lights were still going on. 

The new pallet and general hardware preliminary design review took 
place on 28 and 29 November 1973. right alter the last flight of Phase 1. The 
triplex computer system and the new interface unit would pretty much fill the 
avionics bay behind the pilot. More of the electronics boxes would w ind up 
in the gun bays. On 23 January 1974. George Quinn of Draper Lab brought 
out mockups of a pallet and an attitude-gyro mount. There were no major 
discrepancies, so Phelps authorized fabrication.* 9 

By 1975. the F-8 area of the hangar again looked much like it did in early 
1972. during the first cycle of modifications. Crews moved between the 
simulator and aircraft 802 doing their work. According to Phelps’s notes at 
that time, there were only eight NASA mechanics and technicians and ten 
engineers on the project, less than 20 core persons of a team that would top 
50 when receiving a Group Achievement Award in late 1977. 50 Gary Kricr 
could get into the refurbished Iron Bird and exercise the preliminary software 

" Memo from Calvin !«v» io nulnple addretwe*. 24 Sej». 1923. 
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F-8 Team: 


M« haute */T edmldaw 

lame* D. Il.inlin- 
Willard E. Dive* 

Cxtx Webber 
Water P. Redman 
Hwtey B. Price 
Carl R. Ajirogi 
Allred R. While 
William J. Bonow 


EnHln c»!i 
lame* Ptelp* 
lame* Crali 
Koin Petcucn 
Michael R Earle, pul time 
Calvin larvi* 
kc.iii.-th S/alai 
Remold J. "Joe” Wilton 
R Brute Richuihon 
Gary Knot 
Widen P. Lock 


The Dryden Highl Research Center X-l’risi ot 16 Dec. 1977 lined over 50 name* of NASA enployec* 
receiving ite Group Achievement Award far fly-by- wire 
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releases. The new 680J-typc analog system boxes arrived and were installed. 
Another nagging problem cropped up: F-tis on the USS Hancock had nose 
gear strut failures after about 200 landings— attributed to a deck modification 
that changed the landing geometry when the aircraft caught the number one 
arresting wire on the carrier with its tail hook. Would it happen on concrete?' 
It never did. but it was worrisome. 

The final design review for the entire Phase II system took place on 28 
and 29 May 1975. Forty-eight people were present, including representatives 
from Johnson Space Center and Rockwell for the Shuttle program. The 
agenda shows software reviews filling the entire first day. The second day. 
Sperry had an hour on the computer bypass system: Hydraulic Research a 
half-hour on actuator redesign: Francis A. Fisher of General Electric one 
hour on lightning tests; Rockwell an hour for a Shuttle status review: the 
Flight Research Center an hour to review the aircraft modification status and 
instrumentation: the meeting ending with Langley’s hour on advanced 
control laws. Aside from reports of a few more hardware and software 
delays caused by changes to the system design and continued AP-IOI 
problems, the program appeared in good shape.'' Draper Lab reported that 
the Phase II software development supported the Shuttle Backup Flight 
System work. It too had a cyclic operating system.' 1 

Fisher’s lightning study and recommendations had less impact than one 
would expect with an electronic control system. He found that magnetic 
fields leaked into the interior of the aircraft, and he made some suggestions 
for sealing the leaks. However, leaks were inevitable on an airplane with so 
many openings in the fuselage. The Phase II configuration had the same 
lightning characteristics as Phase I. so Fisher recommended simply to avoid 
Hying into or near thunderstorms. This is good advice for pilots Hying 
airplanes w ith mechanical systems as well. There were no lightning tests on 
the AP-IOI computers themselves, just static discharge tests. Fisher said it 
was not worth the cost to make the processors lightning-resistant." 

Another interesting study done in support of Phase II was "sneak circuit 
analysis." Boeing’s Houston office did this complex work from April 1975 to 
March 1976." A “sneak" is a combination of conditions that cause an 
unplanned event without a hardware failure. These types of failures arc rarely 
caught in system testing and do not have a clear cause-effect relationship. For 
instance, in an electrical network such as the one on the F-8. a "sneak path" 
had data or energy going along an unexpected route. "Sneak timing” would 
be energy- or data- How or a function inhibited at an unsuspected time. These 
arc the most difficult defects to fix after a system is fielded: therefore, doing 

' Phelps. kip numbers. 12 Feb.. 7 Apr. 1975. 

” Calvin Jarvis, memo to muhipte addressees. "Final Design Res tew Ice Phase It System' 4 Jin* 1975. 

“ Juws E. lomayko. C<mpMcn m SptuefbjtlU . Chapter Four. 

“ F. A. Fisher. "Lightning ConsidcrutKins on «K NASA F-8." 

11 Boeing. Sneak Circuit Analysis c4 F-8 Digital Fly-by -Wire Aircraft.' D2- 1 IS5S2- 1 . Ms 197ft. 
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the work parallel with design is much more effective. Boeing found 76 
probable sneak -circuit instances, recommended 12 design changes, and 
found 468 mostly insignificant drawing errors in the documents it examined. 

As 1975 wound down, the Iron Bird pallet had the flight configuration of 
the hardware installed. Wilt Lock was working nights for months with Sperry 
engineers trying to get the computer bypass system operational. Center 
Director David Scott announced in a "State of the Center” talk on 15 Decem- 
ber that the entire F-8 program would end in 1978.'“’ That turned out to be a 
premature statement. 

As the year turned. Jarvis set the first flight of Phase II for 10 May 1976 
and the final push by all hands began. Ken Szalai's weekly reports reveal 
both urgency and thoroughness as he chronicled thousands of tests along 
with frustrating glitches and heroic overwork. In January the team lost two 
weeks because of a failure of the Release 2 software to synchronize the 
computers/ The Bight pallet delivery date was 27 February, then 22 March, 
and it finally arrived on 29 March. The team quickly took advantage of the 
arrival: Gary Kricr flew the simulator with the llight pallet on 5 April and it 
earned ratings of between 1.5 and 3 on the Cooper scale. 5 * Even so. the May 
Bight date was clearly gone, and 10 August became the new target. 

During the third week of June. Kricr Bew the profile for the first Bight in 
the Iron Bird, noting several actuator anomalies and transients. One part of 
the team fixed these while another part concentrated on the software prob- 
lems with Releases 6 and 7. Three days after the Bight qualification review 
on 20 August. Kricr made the first high-speed taxi tests. Then on 27 August, 
he departed Edwards AFB in the F-8 for the first Bight of Phase II* 

Looking back on the development of the Phase II hardware and software, 
the participants agree that they underestimated the system’s redundancy- 
management effort but that it was "workable.” They also complain about 
inadequate tools for system development. The word "agony" frequently 
appears in their remarks. Most conclude, though, that there were few other 
problems and that they had a sound design philosophy. The wide variety of 
uses of the Phase II system— Shuttle support. Bight in a remotely augmented 
vehicle, experiments in sensor redundancy management, resident backup 
software, etc.— supports their belief. Kner's first flight— however delayed— 
was a tribute to their hard work, perseverance in spite of adversity, and 
teamwork. 


Phelps.. log n uniter 6. IS Dec. 1975. 

” Kenneth S/uLn. Weekly Rcpceu, 9. If. and JO Jan 1976. 
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Chapter Seven: The Phase II Flight-Research Program: 
Proof of Concept, Space Shuttle Support, and Advanced 
Experiments 


The Phase II flight-test program began on 27 August 1976 and ended 
when Edward Schneider landed llight 169 on 16 December 1985. In be- 
tween. using the converted F-8. the Drydcn Flight Research Center proved 
that multiple digital computers could be used for flight control, found out the 
optimum data sampling rate for the Space Shuttle, demonstrated that an 
airplane could be flown with control laws operating on the ground, and 
demonstrated advanced redundancy management techniques for sensors and 
other important technologies developed from computer-controlled (light. 
There were some close calls due to computer failures and a runaway pilot- 
induced oscillation, hut the 169 flights all ended without any damage to the 
aircraft. Tire project team designed the flight-control system to be robust and 
to survive problems without a hiccup. There is an impression lingering barely 
below the surface that they wanted a few computer glitches to sec how well 
the redundancy management worked. There was always the proven Com- 
puter Bypass System (CBS) as a backup. 


\ 



The eorr.'K'ted F-8 and the Space Shuttle prototype Enterprise share the ramp in an early 
assemblage of tty-by-wire aerospacecraft. (NASA photo EC78-9354). 


The Phase I mission rules, which guided pilot actions in case of failures, 
had to be changed for Phase II. There had to be some idea of what to do in 




case of single-channel failures now that there were three channels. Going 
directly to the Bypass System all the time was not acceptable. Eventually, 
this kind of flight-control system had to be installed in commercial aircraft 
with no backup. The rules basically came down to a two-pan procedure: try a 
reset of the indicator; then, if a problem persists, return to base in a configu- 
ration governed by this table: 


Failure in: 

If in: 

Return in 

Primary 

Primary 

Primary 

Primary 

CBS 

CBS 

CBS 

Primary 

Primary 

CBS 

CBS 

Primary 


Rules seemed hardly necessary for chief project pilot Gary Kricr. He 
always had a plan, actually several, in ease of any possible emergency. Joe 
Wilson recorded one instance in his diary. On 19 August 1976. there was a 
technical briefing for the first flight with some people present who were 
outside the F-S project team. Milton Thompson and Brace Peterson, two 
highly accomplished pilots, questioned Kricr about his intended aboil 
runways for the test. He quickly answered that lie would use runway 04 for 
departure with a limit of a 15-knot tailw ind and a 5-knot crossw ind. He 
would not use 22 because sufficient lakebcd runways did not exist off the 
departure end for an emergency landing. If there were an immediate abort at 
low altitude, he would turn right to land on runway 17. If the winds were so 
high from the tail that 17 would have too great a crosswind, he would come 
left to 27. If he had enough altitude and speed at the aboil, he would make 
the approach to runway 18. a little farther away. 1 Of course, all this would be 
in front of his mind as he rolled down the runway for takeoff, and he had to 
decide to abandon a particular emergency runway as winds, speed, and 
altitude changed. 

Getting started the day of the first flight was a problem. The Computer 
Bypass System failed its self-test twice in a row. so the preflight was re- 
started. During it. all the monitor lights in the control room on top of Build- 
ing 4800 illuminated, even though the corresponding panel lights in the 
aircraft were lit normally. A canopy latch also malfunctioned. Kricr and 
ground crewman James Hankins determined that the latch problem did not 
affect ejection or pressurization, so they made a manual fix and pressed on.' 
Shortly thereafter, everything righted. Kricr made a deja vu takeoff from 
runway 04 in the primary direct mode, did each planned maneuver, checked 
out each axis of the CBS. and 45 minutes later landed on lakebcd runway 18. 
James B. Craft made sure the three "best" of the nine computers were in the 

1 RonikIJ. -Joe' Wilson. Fllchi Ncee* Diay. 1975- 1977. 19 Aug. 197ft. Diwfcn Hiaorical Reference 
Collection. 

• Wilua Diuy. 1975-1977. 27 Aug. 1970. 
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aircraft for the flight: Serial number three with 2.135 hours of operation was 
Channel A: number eight. 1.576 hours. Channel B; and number four. 2.951 
hours. Channel C.' 

For the second flight on 1 7 September, computer number four moved to 
Channel B and number seven replaced it in Channel C. This flight was a 
watershed for the program. All three computers failed at some time during 
the test procedures, one of them in flight. The objective of this mission was 
"envelope expansion." increasing the range of altitude, speed, and g forces 
the F-K's new control system could withstand. The intended maneuvers 
included sustained flight over 40.000 feet to see how the cooling system 
would work in a low-air-density environment, sustained supersonic flight at 
20.000 feet to check how the cooling system handled moderate heating, and 
4 g turns or higher to see if any mechanical problems would crop up. 

Gary Kricr used the afterburner for takeoff due to the full load of fuel 
needed to achieve the high altitude and speed required for the research flight. 
Alter a normal climb to 20.000 feet. Kner did some small maneuvers to 
exercise all the control surfaces. Then he repeated those maneuvers at plus- 
50-knot-spccd intervals, eventually using the afterburner again to nudge the 
F-X past 500 knots, supersonic speed. He did stability and control tests at up 
to 527 knots. Mach 1.1, then began a supersonic climbing turn to 40,000 feet 
in afterburner. Twenty-three minutes after takeoff, trying to level off. Kricr 
cut the afterburner at Mach 1.21. and within one second the Channel A fail 
light and its associated air-data light illuminated. The computer tried a restart, 
failed, then just quit. Without hesitation. Kricr began to return to base, 
follow ing the rules and staying in primary mode since he was in it when the 
failure occurred. An uneventful landing on the two good computers fol- 
lowed. 4 

The Drvdcn Flight Research Center team was collectively reaching the 
end of its patience with the AP-IOls. The mean time between failure fell to 
its lowest point, dose to 350 hours. Each computer had a personality, and the 
three in the aircraft were the most reliable and best behaved. A failure of one 
of them in the air led NASA to conclude that there was a systemic problem. 
Each computer was modified to fix prior problems, and they were at several 
different modification points, depending on their idiosyncratic failures and 
how long they could be spared from the development and verification effort. 
Jarvis and S/.alai decided to halt flight research and send each one of the 
computers back to IBM for a complete refurbishment, to bring all of them to 
the same modification level, and to hard-wire some of the critical circuits. 
They sent a couple computers at a time back to Owego. New York, so that 
work could continue with the others. Four months later, in early January 
1977. they were all back. 4 

*P4t Dlgiul nv-By-W.ro Flight Report. Flight 80-43-1. 27 Aug. 197ft 
•F4t Digiul Fly-By- Wire Flight Repot. Flight 81-44-2. 17 Sept. 1976. 

' Kenneth S/jIai. tekp<»:iK interview. 30 Sep* 1998. 
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Computer serial number three was in its old Channel A position as Gary 
Krier took off on 2S January 1977. intending to accomplish some of the lost 
mission objectives from flight two. Thirty-eight minutes into the flight, at 
Mach 1.1 and 40,000 feet, almost the exact conditions of the previous failure, 
the Channel A fail lights lit up again. Krier turned the aircraft toward the 
runway and landed once again using the two good channels. The self-test 
routine detected an error in memory. The program tried to restore operation, 
trying 19 restarts before giving up and declaring a self-fail. Immediately after 
the flight, the engineers sent the computer back to IBM for yet another 
refurbishment. 

On the one hand, the back-to-back failures of a computer in flight were 
frustrating, especially after grounding the aircraft and losing months of time 
to seemingly no avail. On the other hand, the system handled the failures 
well. There was an uneventful reconfiguration after these first two in-flight 
failures; less than 300 milliseconds elapsed for identification: no unexpected 
movements of the control surfaces occurred: no change in the flight-control 
system performance was noted by the pilot. Nevertheless. IBM’s projection 
for mean time between failure after the refurbishment was 1.030 hours. The 
actual figure for the first five machines was 354 hours by late April 1977. 
almost the same as in the previous fall before they were sent back to 
Owego." This dismal record was monitored by the increasingly anxious 
Space Shuttle engineers. Jarvis distributed copies of the flight reports to the 
Johnson Space Center and Rockwell. 

One positive result of the flight was the performance of the uprated 
engine that the crew installed during the stand-down. Krier said that it turned 
the airplane into a “hot rod”— one that performed almost as well as the F- 
104. He could understand why LTV could still market the F-8 after 20 years 
in service. 

Krier flew two flights in February 1977 and one in early March without 
incident. These tested the autopilot and the augmented modes. There was 
mixing of the modes such as takeoffs with pitch-and-roll stability augmenta- 
tion on and yaw in the direct mode. When yaw was also switched to the 
stability-augmentation mode. Krier had some jerking when the ailerons 
engaged with the rudder for turns, indicating a problem with the interconnec- 
tion. Thomas MeMurtry flew his flint Phase II flight on 14 March, praising 
the handling qualities of the aircraft. These four successful flights provided 
increasing confidence in the system. The frequency of flights was about once 
every two weeks after they resumed in January. Now followed a burst of 
eight flights in a little over four weeks in direct support of the Shuttle Ap- 
proach-and-Landing Tests, which were to begin in the summer. 


-Cilvin lurvit iuxcto.1. 4/77-3/78: 3) Apr 1977. 
Wilvm Dux). 1975-1977. 28 Inn. 1977. 




The First Space Shuttle Support Rights 


Draper Laboratory built the software for the Space Shuttle Backup Flight 
System. The original idea was to use five computers in the primary control 
system with no backup. When all the actuators, cable runs, and digital 
channels were sorted out. the Shuttle engineers decided to use only four of 
the computer*. The fifth computer, since there already was space and power, 
was kept as a backup. NASA contracted with International Business Ma- 
chines Corporation (IBM) for the software in the primary system. When the 
fifth computer dropped out of that configuration. NASA decided to obtain the 
backup software from a different vendor.* Rockwell won that contract and 
turned to Draper Lab for the work, the reasoning being that a different set of 
programmers would help reduce the probability of a generic software prob- 
lem. 

Final approach and landing w as a critical mission phase for the Shuttle, 
more critical than on a conventional aircraft since there were no engines for 
it. This meant one try. and one only, at making a successful landing. The 
Soviet Union, building its Shuttle ten years later, kept air-breathing engines 
in the design for help on approach, not wishing to take the risk the Americans 
took. To practice landings at minimum cost. NASA bought a used Boeing 
747 from American Airlines, modified the tail to make room for the Shuttle, 
and used it to launch the Enterprise. This was a Shuttle Ortiitcr minus a 
number of systems not needed for approaches and landings, such as thermal 
protection tiles, engines, reaction controls, and orbital maneuvering systems. 

The F-8’s eight support flights in the spring of 1977 earned the Shuttle 
Backup Flight System's software test package. With it running in parallel 
with the F-8 (light-control software, the pilot would enter code 60 on the 
Computer Interface Panel to shut off the aircraft's usual downlink data 
stream and switch to the piggybacked software’s downlink. He would make a 
series of Shuttle landing profiles: then he would enter code 61 to switch back 
to the normal downlink. 

Ken S/alai ran the Shuttle software in the simulator when it arrived. One 
of the prellight test programs had a restart occur during execution. Szalai. 
very concerned, visually inspected the listing that Draper Lab always sent 
with the flight tapes against one made at Dryden. He was surprised to find 
that two locations on the tape did not match those on the listing, despite 
several layers of checking and cross-checking during tape manufacture. The 
first Shuttle support flight was only a couple days away, so he immediately 
began work on a fix. He got the program to work properly by manually 
entering the code from the listing onto the tape. However, according to the 
usual procedures, any fix would have to be made and re-verified at Draper 
Lab. which would take days. The software managers agreed that they would 
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just skip the preflight test involved and work around it. At a briefing on the 
problem on 17 March 1977. S/alai asserted that there would be no compro- 
mise in High! safety because the test simply checked values in rate gyros and 
accelerometers, and there were other tests that verified sensor integrity but 
did so indirectly. Also, the sensor redundancy management program provided 
safeguards as well. S/alai recommended the flight take place and that a long- 
term solution be found. He needed Draper Lab to concur. Vincent A. Megna 
faxed S/.alai one paragraph of agreement the next day. almost as the aircraft 
was taxiing out to the runway.* 

MeMurtry then Hew the first of the Shuttle support test nights on IX 
March 1977. He rehearsed the free night profile number one to lakehed 
runway 1 7. The Shuttle itself made approaches at a much higher speed than a 
powered aircraft. To simulate this. MeMurtry kept the power pulled back and 
deployed the speed brake. He dropped at a very high descent rate six times 
toward the desert, each approach consistent with the others. 10 Kricr Hew 
profile number two on 21 March, also with good results. The next day 
MeMurtry went up in the morning to practice profile five, and Kricr new 
profile four in the afternoon. Three weeks later, the pilots switched order. 
Krier tried out profile two again and MeMurtry profile one in the afternoon. 
The next day, 15 April, this set of test flights ended with another double- 
header: MeMurtry profile two and Krier profile five. Now the F-X program 
had assisted the Shuttle development with aerial work to complement the 
experience of solving hardware and software problems with the AP- 101. 
Flights of the F-S halted then for two months while Langley Research 
Center's Remotely Augmented Vehicle experiment went through final 
preparations. 

The Remotely Augmented Vehicle 

Since the beginning of planning for Phase II. Langley worked to make its 
contribution to the program an exploration of advanced control laws. To 
make it easier to change the software containing the control laws, the Flight 
Research Center proposed having it resident on a ground-based computer. 
This would avoid the costs of verifying complex research (light-control laws. 
Telemetry downlinks would provide the vehicle state to the computer on the 
ground: it would do its calculations and then uplink commands to the actua- 
tors. just as though the machine and its software were on the airplane. This 
method has obvious risks, so. even though there would still be two flight 
control systems on the aircraft in ease of telemetry or computer problems. 
Langley opposed using a ground-based system. Weeks of discussion fol- 
lowed. but the issue created an impasse between the two NASA centers. It 

" Kenneth S/alai. “The Hue in the Tape Prcfckm.' tmeting tliilet. 17 Mar. 1977. Chyifca History Office; 
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seemed thal Headquarters might have to make this decision.' 1 But by spring 
1974. everyone finally agreed on using a ground-based computer. During the 
aircraft modification, space then had to be found in it for an antenna, digital- 
to-analog converter, and a receivcr/dccoder. Robert Borek and James Craft 
identified places by early 1975.'* 

By the final design review for Phase II in late May 1975. Langley 
reported that it had finished advanced control law concept one. that for a 
control configured vehicle. (This was encapsulated in software alone: Dryden 
abandoned the plans to physically modify the F-8.) Langley’s engineers 
developed an integrated package including the direct and augmented modes. 
The design objectives included aircraft-maneuver load control and gust-load 
alleviation using direct lift plus envelope limiting, with no modification to 
the F-8 aerodynamic characteristics. This set of control laws would thus 
demonstrate many of the advantages of control configured vehicles: 
smoother ride in turbulent air and increased lift by using all surfaces to 
develop it. Horizontal stabilizers conventionally produced downward forces 
for balancing an aircraft about its center of gravity. This configuration would 
obviate the need for that by maintaining active stability. The Langley engi- 
neers completed a version of the software with this functionality axled in 
FORTRAN by February, and it worked well in the simulator. Tlic arrival of 
an AP-101 at Langley would allow them to complete their work. 1 * 

The ground-based control system initially consisted of a simplified 
version of the roll-and-yaw stability augmentation and pitch-control augmen- 
tation modes. There was no autopilot or side-stick support. Structurally, the 
software had an executive routine that contained the interrupt structure and 
the synchronization logic, plus five subroutines. Four of them executed the 
control laws, one of which handled the trim commands in a faster inner loop, 
with general feedback in a slower outer loop. The other one performed 
initialization and ran synchronization in the background. The telemetry 
downlink data went directly into the routines, and the executive controlled 
the uplink of the four 10-bit command words." The remote-augmentation 
experiment started with a sample rate of 100 per second, but this could be 
easily adjusted. ' The pilot would engage the ground system by entering code 
21 for pitch. 22 for roll, and 23 for yaw via the Computer Interface Panel. 
Shortcuts included code 24 for both roll and yaw. and 25 for all three. 
Voluntary disengagement was through selecting a mode other than that in the 
remotely augmented vehicle experiment list. 16 The system would automati- 

11 Jamci PlMlpt. fog number 4. 25 Jan 1974: 1 1 Feb. 1974 
“Jiimci PhdjB. It? number 5. 4 Feb. 1975. 

“ Calvin Jan it. iwnxi for dnlrihation. 4 June 1975. 
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tally disengage because of uplink failure, a surface command rale exceeding 
a preset limit, or the autopilot becoming engaged. The machine used in these 
experiments was a Varian V-73 engineering minicomputer. For the remotely 
augmented vehicle flights, the AP-lOls contained software with reasonability 
constraints and did nothing else except check the uplink signal for sensibility 
before passing it on to the actuators. Interestingly, the aircraft envelope for 
using this mode had a minimum value instead of a maximum: I5.(K)0 feet or 
above so a signal could be received without any ground interference." 

It was difficult to stall the remotely augmented vehicle tests due to 
failures and aborted flights. Flight 16 of the Phase II program took place on 
15 June 1977, delayed a month due to a modification to the mode control 
panel to eliminate mechanical switching problems. Digital caution lights 
came on in the air w ithout any related warnings from the annunciator panel, 
so the controllers aborted the flight and Kner returned to base. The remotely 
augmented vehicle mode was activated in a monitor setting. The crew then 
observed a couple of software problems that were quickly corrected. 1 * Two 
weeks later, the next flight had a goal of open-loop checkout of the remotely 
augmented vehicle mode. A low-cnginc-piessure warning caused this flight 
to be aborted as wcll. lv Finally. Tom MeMurtry flew an uninterrupted test on 
15 July, reporting that it was difficult to stop rolls at the desired attitude in 
the remote-augmentation mode.*' That was the last open-loop preliminary 
test of the system because flight 19 suffered a computer failure four minutes 
after takeoff. Channel A again was the culprit, except that AP-101 serial 
number four was in place there instead of the twice-failed number three. 
Ironically, four was a replacement for serial number two. which went out 
during the preflight tests.’ 1 

As these initial shakedown flights took place, the Dryden Systems 
Analysis Branch wrote the final version of the closed-loop remote augmenta- 
tion software. Kevin Pcten«cn led this effort. There was a design review of 
this software on 3 1 May 1 977. and only a little more than two months later a 
software readiness review for flight took place. Petersen named this version 
of the progmm RAVEN (Remotely Augmented Vehicle Experimental Norm). 
It was the baseline for later remote-augmentation experiments." 

RAVEN had its first test on 8 September 1977. Kner tried out all the 
flight axes individually and then collectively, noting that the stilt ware en- 
gaged and disengaged as planned with no transients. He repeated the tests six 
days later. After that, there was a break of over four months w hile the project 
tried some tests of ride-smoothing software and recovered from yet another 

" Kevin Pcicrxn ami Kenneth Sabi. "I S Software RcVmv: Documentation.' - PX-77-OI4. 3 Aug. 1977. 
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computer delay. By early September, there were no spare computers for flight 
test.' 1 When MeMurtry suffered a hard failure of Channel B (computer 
number five) on 15 September, there followed two months on the ground 
while IBM fixed enough computers to provide some margin. On IS January 
1978. Kricr tried the remote-augmentation again but had to quit because the 
antenna failed. MeMurtry was able to accomplish the evaluation on 14 
February, repotting that lateral response was too sensitive with the remote 
system engaged. That spring, several additional flights expanded the enve- 
lope of the RAVEN system. 

One of the chief advantages of using RAVEN was the low cost and time 
involved in making changes because of the high-level programming language 
and ability to have the experimenter instead of an outside group change the 
program. In addition, the flight verification testing was considerably less than 
with a new program on a computer aboard the aircraft— resulting in consider- 
able time and cost savings. Costs were $10*20 per word and one-day turn- 
around for changes to the remote-augmentation software versus S 100-300 per 
word and two weeks or up if Draper Lab did the work on the embedded 
system. The high point of 197S for the remotely augmented vehicle system 
was a series of 15 Bights, seven to explore low sample rates, eight for testing 
adaptive control laws. The sample rate record was 6.7 samples per second, 
about one-sixteenth of the initial rate.' 1 From 2 February to 9 March 19S2. a 
series of six flights using the remote-augmentation technology showed its 
continued flexibility. These Bights tried out the concept of variable gains. 
This experiment was by a team from Dryden implementing the ideas of a 
group from the Royal Aircraft Establishment in England. Called the Coopera- 
tive Advanced Digital Research Experiment (CADRE), it had a baseline loop 
with fixed gains and another loop in which the gains dynamically varied 
based on actual performance in near-real-time.- There was a follow-on series 
of 24 advanced CADRE Rights during the year from June I9S2 to May 1983. 
The entire remote augmentation test program was successful enough to merit 
copying by the Advanced Fighter Technology Integration (AFTiyF-16 
project for some of its work and to be considered by others. 

A Second Round of Shuttle Support 

The frcc-Bight portion of the Shuttle approach and landing tests began on 
12 August 1977* At the end of the fifth Bight. 26 October 1977. the Enter- 
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The heavily insirumented Iron Bird w«h lives AP-IOIs in the aviorics bay. The Shullle suepcrt 
missions were practiced over and over, using the sirrulaior as She primary tool. (NASA pnolo 
ECN-5220). 

pnsc suffered a major pilot induced oscillation. Fred liaise of Apollo 13 fame 
was at the controls and Prince Charles of England in attendance as the big 
blocky glider quickly descended in perfect weather. As it closed to within 
thirty feet of the runway, Haise rolled slightly, seeming to search with the 
main gear for solid ground. A moment later he touched down hard and the 
Shuttle bounced, pulsed down in pitch and rolled sickcningly to the right. 

The roll kept up for a few cycles until the craft expended enough energy to 
make a landing unavoidable. This oscillation seemed to happen because of 
transport delays in the control system. Between the time the pilot moved the 
control stick and the time something actually happened at the control surface, 
there was a gap on the order of 200-300 milliseconds. The delay was due to 
the time needed to do analog-to-digital signal conversion, control law 
execution, and digital-lo-analog conversion, as well as to the length of the 
wires and lag in the hydraulics. If the delay is too long, the pilot will lose 
patience and deflect the control device even more, but by that time the first 
set of commands is in process, so the effect is soon much higher, causing an 
overshoot. Seeing this, the pilot reacts by giving an opposite command, and it 
may result in an overshoot in the other direction. Then the task becomes one 
of damping the oscillation while the runway quickly grows outside the 
window. The pilot also must be in a "high gain" situation, such as landing or 
tight tracking. Otherwise, the PIO is not likely to show up. That was why it 
was not picked up on the thousands of hours of Shuttle simulation. 

The Shuttle program asked the F-X team to help find out the range of 
transport delays within which the pilots arc likely to avoid inducing oscilla- 
tions. The engineers fimt tried to do this using the remote-augmentation 


112 


system. Tom MeMurtry and Gary Kner each tried one flight evaluating 
various delays and trying high-speed approaches. To help cut drag and keep 
the kinetic energy up. the mechanics removed the landing gear doors and the 
pilot kept the wing in the down position.' resulting in approach speeds of 
over 200 knots, closer to that of the Shuttle. The flights occurred on 24 and 
25 March 1978. and both pilots lost the radio connection to the ground 
facility due to excessive vibration and blown fuses. The tests would have to 
wait until an on-board version of the transport delay software arrived. 

While the project waited for the software upgrades, two more pilots 
checked out in the F-8. Einar K. Enevoldson and John A. Mankc came to the 
project bringing experience landing lilting bodies, which exhibited low lift- 
over-drag profiles like those of the Shuttle. In fact. Mankc held the record for 
most flights in the lifling-body programs/' Both flew high-speed approaches 
as part of their check rides. Now’ four pilots could help attack the oscillation 
problem. 

Draper Lab built variable delays into the flight-control software, and 
these could be selected through the computer interface panel and the five- 
position switches. On 7 April both MeMurtry and Krier tried out the new 
program, flying seven and eight approaches respectively on one flight apiece. 
MeMurtry commented that when the transport delays got Kw> long or gains 
were wrong, he found himself adapting to them by pulsing the controls. He 
commented in his pilot report. "It was almost as if I was playing some kind 
of game w ith the airplane. I would make a gain change and then I would see 
how I could adapt to that gain to make the airplane behave reasonably well. I 
was surprised to (see) how well I could adapt. 

Six more flights followed within the next ten days with all four pilots 
participating. Counting the first two flights on 7 April, they flew 57 high- 
speed approaches. The Enterprise would have taken over a year to do the 
same since it was limited to one approach per flight and each flight required 
loading on to the 747. On the 1 8 ,K . John Mankc took off. intending to add to 
the total of high speed approaches. On the last of his six that day. he roared to 
the runway at 265 knots with 100 milliseconds of delay added to the F-8’s 
usual response time. From the ground camera film of that approach, it looked 
like Mankc pulled the nose up a little too high on the ensuing takeoff and 
compensated with a quick and clearly excessive downward pulse, causing the 
F-8 nearly to land nose-first. It took over five pulses to settle on a good 

’’The F-S hod a variable in:i&itcc wing wall a hinge to Ihu pilxt coulil raitc the wing n a higliei angle 
ot incideiKC (or low • speed battling) on currim. To limulute the Shuttle la inline tpeedt. pilot) ilnl their 
afpoaclK* in the F-8 DIBW with the wing at the lower incidence, what it referred to It re a» ihc down 
position.'' 

’ R. Dale Reed with Darlene Lifter. Wluglea Flight: 7)ic U/ling Body Slort (Washington, DC: NASA 
SP 4231. 1997). p. »viii Actually. Mill Thanptoa had a higher number of total flight), hut almox all U 
them were in the lightweight . empowered! M2-FI. Manic had more flights in the powered lifting bodies 
than rmvone cite. 
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departure attitude and begin to gain altitude. The film from the tail camera is 
quite dramatic, with the runway filling the screen on the first oscillation. 10 
Actually, what happened was that the control system worked against him. 
lengthening the recovery. He reported trouble in controlling pitch the entire 
flight. On the fifth approach, he commented. *“|l| just got it in my mind I was 
going to drive that thing into the ground." Manke used a series of small pitch 
inputs to get there, '“probably a classic PIO [pilot induced oscillation) down 
to the ground.” As he rotated after the high-speed touch-and-go. the landing 
gear struts suddenly compressed, causing the pitch rate gyros to respond in 
such a way that the software disengaged the control/augmentation system 
and put it in the direct mode. The direct mode had degraded handling quali- 
ties relative to the conlrol/augmcntation mode, making it more difficult to 
recover. Manke first turned off the delay, then manually engaged the pitch 
stability/augmentation system to help in finally damping the oscillations. ' 1 
As a relieved Manke pulled away. Gary Kricr deadpanned from the control 
center. ”Uh. John. uh. 1 don't think we got the data on that. We'd like to have 
you run that one again."* 1 

This senes of flights produced valuable data about handling characteris- 
tics with transport delays from 20 to 200 milliseconds. By flying the Shuttle 
landing profile, the pilots gathered data that helped set reasonable sample 
rate and control law execution limits. These tests also resulted in the Dry den- 
developed PlO-suppression filter that was tested in the F-8 and implemented 
into the Shuttle software prior to the first flight, eliminating the problem 
discovered by Fred Haisc. Tins ended direct Shuttle support, though research 
on pilot induced oscillations occupied the program on over 30 more flights. 
The F-X team moved into what was informally known as “'Phase IIB." a 
scries of experiments by Dryden engineers and those from outside the Center. 
The CADRE experiment (treated above) is one of these. Three of the others 
that had significant impact were: adaptive control laws, sensor analytic- 
redundancy management, and resident backup software. 

Adaptive Control I.aws 

The teams at Langley and Dryden agreed to develop two control law 
packages for Phase II. The baseline was the Active Control Law Set. This 
demonstrated the potential benefits of active control for future aerospace 
vehicles by using algorithms that went beyond conventional stability aug- 
mentation systems. Aside from improved handling, gust alleviation, and drag 
reduction, the active control laws could control the aircraft while unstable in 
pitch due to moving the center of gravity aft. This rcduccd-static-stability 

“ VideoUfte No -VO. ~Aeronzu:ical Might RfvMirdi." in the NASA Dryden Mi-uoric.il Video Reference 
Collection. 

F-8 Digital Fly-By-Wkc Flight Report. Flight I25 SS-4A. 18 Apr 1178. 
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configuration is used in the F-16 and many later fiy-by-wirc aircraft. The F-8 
team based the active control laws on a design study by Honeywell. Inc. that 
explored the linear quadratic optimal control method, which first finds the 
best weighting parameters, then finds the best feedback gains, and finally 
makes these into gain schedules that achieve the performance criteria.'' 

When the conv ersion of the F-8 from Phase I to Phase II just began, the 
Honeywell engineers made a proposal for the second type of control laws, 
the Adaptive Control Law Set. They suggested an experiment to try out 
adaptive control laws on the simulator at Langley, then in flight. Eventually 
the adaptivc-control-laws experiment had the broadest base of any in the F-8 
program, involving researchers from universities, industry, and government. 
The original idea was to use the power of digital computers to make the 
control laws able to adapt to a changing flight environment, improving 
handling and reliability. Adaptive control laws had been a dream of airplane 
designers for decades. Aircraft operate in a constantly changing aerodynamic 
environment. Dynamic pressure. Mach number, angle of attack, etc., cause 
wide variations in air data. The configuration of the aircraft also causes 
variables: the location of internal and external stores, such as fuel tanks and 
weapons, as well as the geometry of the airplane. In an analog system the 
control laws arc necessarily fixed in hardware. In the Apollo computer during 
Phase I. no matter what happened, the control laws in software executed 
statically (in each mode such as wing up or wing down). Changes to them 
meant re-programming. Adaptive control laws would take outside data and 
the results of previous commands and dynamically project the best solu- 
tion. 1 * 

Honeywell engineers initially proposed up to five candidate methods to 
create adaptive control laws. These were the Newlon-Raphson technique for 
identification ami algebraic gain solutions, a recursive least-squares ap- 
proach. model tracking, high-gain model following, and the Lyapunov model 
reference technique. The people from Honeywell thought NASA preferred 
the first two. but they gained expertise in all five through various study and 
development contracts. The common thread in them all was high mathemat- 
ics volume, which could only be accommodated on a powerful digital 
computer. Langley sponsored projects to explore some of these candidates. 
R.C. Montgomery of that research center teamed with two City College of 
the City University of New York professors. R. Mckel and S. Nachmias. to 
define a learning system for control. It had three components. The first was 
an information acquisition subsystem that used either the N'cwton-Raphson 
technique or Lyapunov’s method to identify instantaneous values of the 

" S. R. Brown. R. R. Luton. K. 1. Suit.. and R. 1. Wilton. 'F-H Digital Fy-By-Wire Active Control Law 
UcclopriKM .ir>J Flight Ten Result*.’ mti***npt. 2(i Aug. 1977. In if* Dtyden Flight Research Center 
II i ties Office. 

“ Itrrttyncll. "Honeywell Digital Adaptive Control Laws fc* the F H.' Volume I. Technical. VI ureupoltv 
MN. 15 Ian 1974. 
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parameters and then monitor their performance. The second component was 
a learning algorithm subsystem that related the actual performance to a 
model of projected performance using the least-squares technique. The last 
component computed the feedforward and feedback gains." Dr. G. Kaufman 
of Rensselaer Polytechnic Institute studied the model-follow ing technique. 
Dr. M. Athans of MIT suggested a multiple modeling system. 

In mid- 1 977, two Honeywell engineers proposed another method. Gary 
L. Hartmann and Gunter Stein developed what they called Parallel Channel 
Maximum Likelihood Estimation (PCMLE) software. This program calcu- 
lated the most likely gains in the longitudinal axis by measuring pitch rate, 
acceleration, and stabilizer position. Honeywell implemented it in FOR- 
TRAN-IV on a CYBER computer using several parallel channels of Kalman 
filters. The program had likelihood functions for each channel, and the gains 
from the channel with the maximum likelihood were used for controlling the 
aircraft.'" 

A selection committee consisting of Jarvis, S/alai. and Dccts of Drydcn 
and John Bird. Jarrell Elliot. Raymond Montgomery, and Joseph Gera of 
Langley decided among the various schemes. The decision criteria were: 
Docs the concept represent state-of-the-art thinking in the control or estima- 
tion field? Is there a potential payoff in the application of the concept to 
future aerospace vehicle control? Is there a sufficient theoretical basis? Will 
Bight testing enhance the concept? The idea that seemed to have the best 
answer to all of these questions was PCMLE. They decided to try out three-, 
five-, and ten-channel implementations, and also a rcduced-sample-ratc 
version. Szalai's software team installed the final program on the Varian 
ground computer and built a program called RAV ADAPT for the AP- 101 
computer* that took care of the interfaces between the PCMLE system and 
the aircraft. They used actual Right data as inputs to the system during 
development, which helped tune the Kalman filters before Right.' 

Gary Krier piloted all seven Rights of the adaptive-control-law experi- 
ment. On 24 and 25 October 1978, he flew the Right profile planned for the 
experiment with the ground system in the monitor mode. Then in November 
there were five Rights trying out the various channel and sample-rate combi- 
nations. The researchers learned that a low rate of 17.8 samples per second 
resulted in better following due to its scale being closer to the actual com- 
puter word size, and thus more accurate. They also found out that the five- 
channel system was superior to the three- tir the ten-channel versions.® 

One current application similar to the adaptivc-Right-control concept is 

“ R. Mekel. R.C Montgomery, and S. Nachmiot. ’ Learning Control System Studies lor the F-8 DFBW 
Aircraft," manmerip, Dryden Flight Rescurch Center History Office. 
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B.A. toner* and K. J. Sialai. “Adoptive Control Flight Test Completion." Milestone Report FX- 78-029. 
17 Dee. 1978. pp. 1.3-9. 

* Powers aid S/alai. "Adaptive Control Flight Test Completion." (f> 9. 13. 





NASA research plot Dick Gray Mew a series of missions in 1962 with a dummy fuel probe to see 
how the ny by wire system handled »i the aerial relueling environment. This Ihree-pholo 
sequence shows a successful link-up with a Navy KA-6 tanker. (NASA photos ECN- 18439. ECN- 
18443, and ECN- 16444). 


the use ol tape cartridges on F- 1 6C and D models to inform the llight-control 
computers of the aircraft configuration on any particular mission. The F-16A 
and B series had analog flight computers. A precursor system to adaptive 
laws, though exhibiting static behavior due to the hardware, was the gun 
tracking on the As and Bs. The cannon on the F-16 is mounted in the wing 
root on the left side of the fuselage. Since it is offset from the centerline, a 
special yaw-control circuit uses the rudder to compensate for recoil whenever 
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the trigger is depressed. When digital computers came into use on the F- 1 6. it 
became possible to tell them the location and weight of the fuel and weapons 
loads carried on external hard points. When a missile is fired, a fuel tank 
emptied, or a bomb dropped, the computers can maintain optimal perfor- 
mance by adapting their commands to the context of the new configuration. 

The adaptive-control-laws experiment was Gary Kricr’s final one with 
the F-8 program. Stephen D. Ishmael. who joined the Center's cadre of pilots 
in 1977, checked out in the F-8 the day after the last adaptivc-control-Iaw test 
flight so the pool of project pilots could stay at the same level. In February 
1979. Krier Hew his last two missions to get vibration data on the flight 
pallet. He then moved on to law school and a second career in aerospace 
administration. The aircraft stood down until late September, as the project 
team prepared the next experiment, sensor-analytic-redundancy management. 

Sonsor-Analylic-Kcdundancy Management 

The active and adaptive control laws received triplex-sensor data that 
was filtered by a redundancy-management algorithm, which yielded mid- 
values under non-failed conditions. The sensor-anal y tic-rcdundancy-managc- 
ment experiment used dual-sensor data to sec if the number of sensors could 
be reduced and if the accuracy of the data sent to the computers could be 
increased. This work originated at Langley, which contracted with Draper 
Lab for it. James C. Deckcrt of Draper was the principal, and he assembled a 
small team including A. Willsky of MIT’s Electronic Systems Laboratory. 

The primary technique used for failure detection and identification was a 
method that evaluated output differences using relationships among variables 
measured by dissimilar sensor types. When the range between two sensor 
readings passed a certain threshold, one had probably failed. The essence of 
the problem was deciding which one. By using data from other sensors in 
certain arrangements. Deckcrt thought that he could figure out which sensor 
of the failed set was actually working. The second method was straightfor- 
ward: constantly self-testing each instrument, and if its output over several 
cycles exceeds the physical limits of the aircraft, simply isolate it from the 
system. Draper Lab verified both methods by using actual data from previous 
Bight research. 

The analytic-redundancy-managcmcnt algorithms used eleven dual 
sensor types: three accelerometers mounted in orthogonal axes, three sets of 
gyros, the anglc-of-attack indicator, the altimeter, the Mach meter, and the 
vertical and directional gyros. The algorithm operated in a monitoring mode 
aboard the F-8; its presence had no influence on the sensor signals used by 
the control laws. That way. its results could be compared to actual events. Of 
course, it only used data from two of the triplex sensors. The flight code itself 
could simulate sensor failures. The software consisted of the analytic- 
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redundancy-management section and the interface to the computer-input 
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panel for ihc pilot to control the testing through selecting varied values for 
key parameter and failure injection of several kinds: drift, hardovers. loss of 
signal, and transient pulses. To stave off the combinatorial explosion of data 
made possible by using so many sensors. Deckcrt's team devised the sequen- 
tial probability ratio test, which minimized the number of observations 
needed to choose between failures and non-failures. iv 

There were four types of analytic redundancy used in the algorithm. The 
rotational kinematics analysis related outputs of the rate gyros and the 
vertical and directional gyros. Altitude kinematics related the altitude given 
by the barometric altimeter and the double integral of the accelerometer and 
vertical gyro outputs. Translational kinematics involved the integrated 
outputs of the accelerometers, vertical gyros, rate gyros, and the air data 
sensors. Lastly, translational dynamics compared detected and calculated 
aerodynamic forces.*' 

The analytic-redundancy algorithm did not rush to judgment. If values 
differed from the previous sample by the magnitude of the failure threshold, 
the software declared the sensor provisionally failed. If the values returned to 
the expected range by the next sample-processing cycle or two. then the 
program lifted the provisional failure, or. if the values continued to be outside 
the acceptable range, it declared a hard failure. 

This experiment started as early as June 1975 and ended with a final 
report in September 1982." It began with a Langley study contract given to 
Draper Lab to explore the reduction in the number of control sensors. The 
initial work lasted two years and resulted in a FORTRAN program running 
on an Iron Bird at Langley Research Center, demonstrating the redundancy 
concepts. It took two more years of work to get the software ready for the 
actual aircraft. Finally. Steve Ishmael made the first flight test of the Phase I 
analytic-redundancy management software on 26 September 1979 (not to be 
confused with Phase I of the F-8 DFBW's overall flight research). He flew it 
again on 31 October, three more times between 21 November and 29 Novem- 
ber. and then on 7 February 1980. Draper modi fled the software and refined 
the experiment for a Phase II flight-test program. Ishmael was the pilot on all 
of these as well. He made the first two flights in late October 1980 and 
March 1981. It became obvious that the directional gyro and vertical gyro 
outputs were difficult to analyze at high roll rates, so they were removed 
from the algorithm. The final three flights in June 1981 earned this modified 
software. 

The experiment was successful in proving analytic redundancy could 
work. One frequently cited incident is that the analytic-redundancy-managc- 

* June C. Decked. "Ddailta of ihc F-8 DPBW Aircraft Control Senior Analytic RedmdaKy 
Management Algorithm.' R- 1 1 78. Outlet Sort Draper Laboratory. Inc.. Aug. 1978. pp. 1 . 7. 19. 74 5. 
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mcnl software declared a sensor failed 24 seconds before ihc primary did. 
Even so. there is little use of this concept in operational aircraft today. One 
reason is that there is some comfort in hardware: the thinking is that despite 
the penalties, three sensors arc better than two. Another reason is that the 
analytic-redundancy software was never flown as the primary source of 
sensor data, leaving one important step toward practical use not taken. 

REBUS: Resident Back-Up Software 

One of the last experiments down on the F-8 digital fly-by-wire airplane 
was REBUS, or REsident Back-Up Software. Ken S/alai said that its story 
“shows the power of night." because few believed in the idea until after the 
Bight research series.*' S/alai. Dwain Dects. and Wilt Lock were the Dryden 
engineers behind this effort, with Vince Megna leading at the Draper Labora- 
tory. It spanned the years 1984 and 1985. 

Since the primary night-control system in the F-8 had three identical 
channels with identical software, there was a danger of a “common mode" or 
“generic” software failure bringing down the entire system with all three 
channels failing nearly simultaneously. Dissimilar software in the three 
channels would greatly reduce this possibility, but it would triple the expense 
of verification and validation, which had nearly broken the program testing 
only one implementation. This is why the aircraft had a Computer Bypass 
System as a backup and why the Shuttle program retained a fifth computer 
and loaded it with software with greatly reduced functionality that could do 
little else but bring the spacecraft home. The team wanted to see if the 
backup hardware could be removed from the design. The solution it em- 
ployed was to use a relatively simple external hardware device to monitor 
fault declarations along with software resident in the computer memories that 
could provide basic flight control. The primary redundancy management 
system expected only single faults. If all three channels had alarms close 
together, the REBUS system assumed that there was a generic fault and 
forced a transfer to the software.*' 

The REBUS itself worked asynchronously and autonomously. It was a 
basic fixed-gain stability augmentation system. It could provide the aircraft 
with better handling qualities than the analog backup, but ones that were not 
as good as the primary system provided. There was no sensor redundancy 
management, no exchange of data, no synchronization, and no gain schedul- 
ing among the computers while running REBUS. If there was a hardware 
failure of one of the computers, there would continue to be output variances 
among the three machines. The system handled this by using mid-value logic 
on signals to the actuators. The largest obstacles to using the REBUS were 
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the initial switchover and the loose synchronization when it started running. 
Lock and Megna felt that they could reduce transients during switchover by 
using the last sensor data values sent to the primary system. Since the switch- 
ing process took less than 20() milliseconds, the data would still be good. The 
synchronization process they defined was: 

1 . A computer set its own discretes high. 14 

2. It would search for high discretes from partners. 

3. The computer would allow 400 microseconds for finding them. 

4. If high discretes were found from at least one other computer, then the 

system would proceed or go back to step I. 

5. The computer then set the discretes low. 

6. It searched for low discretes from each member whose high discretes 
were found. 

7. The machine allowed up to 400 microseconds to find them. 

8. The computer would exit the synchronization routine if synchronized 
with one other member: otherwise it would return to I.*' 

After developing the software and the inevitable testing on the Iron Bird, 
the project team held a flight readiness review on 17 February 1984. The first 
research Bight followed a few months later. 

The three-channel control system Hew for eight years prior to the start of 
the REBUS testing and was quite reliable. Therefore, instead of waiting for 
faults to appear, the REBUS software caused failures by writing to write- 
protected locations. The timing of the fault injection could be controlled by 
the pilot via the computer interface panel. Edward Schneider, a former Navy 
test pilot who joined the Center in 1983. took off on 23 July 1984 to evaluate 
the system using a very ambitious Bight-test plan containing 81 items. The 
plan was to arm the REBUS at 0.6 Mach and 20.000 feet, check out the 
computer bypass system to be certain of a fallback, then transfer to REBUS. 
First Schneider would do pulses in all axes and some maneuvers. Then he 
would go back to the primary system to be sure that worked. He would then 
expand the envelope by going back to REBUS, doing some 2g maneuvers, 
downmodc to the computer bypass system, back up to REBUS, back to the 
primary again, and repeat these cycles with different maneuvers a few more 
times. Finally, he would make simulated approaches in REBUS, do some 
touch and goes and low approaches, and then land, controlled by the primary 
system. 40 The test was so successful that Rogers Smith, a highly experienced 
research pilot who joined the Center in 1982. made the landing in REBUS 
after its second Bight on the 27"’. Schneider Bew REBUS again in August, 

Discrete* are vjIicn ih,il n.-nil an oent cr j lute. 
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Smith in September, and Schneider finished the test program in 1985 with 
flights on 1 February and 2 April. Problems with Channel A. weather, and a 
couple lateral-directional handling-qualities flights caused the gap from 
September to February. Most of February and March were devoted to a ten- 
flight senes called the Optimum Trajectory Research Experiment (OPTRE) 
that involved data uplink and downlink between the F-8 and a computer in 
the new Remotely Piloted Vehicle Facility. 4 ' Schneider's last REBUS flight 
in April was the second to the last of the F-8. 

In the six test flights, the REBUS was active for three hour, and 54 
minutes. There were 22 transfers from the primary system to it. with six of 
those at greater than one g. The experiment was a valuable contribution to the 
rcconfigurable software systems developed for aircraft today and is used on 
the B-2.“ It also focused the redundant versus dissimilar software debate, 
which eventually led to the differing implementations by Airbus and Boeing 
discussed in the next chapter. 



Two F-8s in early retirement: the fly-by-wire aid supercritical wing testbeds await relutbislvnent 
into permanent displays at the Dryden Fight Research Center. INASA photo EC91 -194-23 by 
Jim Ross|. 
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After REBUS the F-8 was an airplane without a mission. There was a 
final tape release. 17C. which improved the aileron feel system. Schneider 
tried it out on 16 December 1985 with a Bight aimed mostly at clearing the 
cobwebs and keeping the airplane ilyablc. The actual airframe was intended 
to be the basis of a new oblique wing test program, but it was cancelled due 
to a redirection of Navy fighter and attack aircraft tactics. (The Navy was a 
joint participant in the program.) So. the 169" flight of Phase II. the 211* of 
the overall program, was the F-8’s last. After over 13 years of service as a 
digital fly-by-wire testbed, it sits gleaming in the desert sun on a pad in front 
of the Dryden Flight Research Center, the F-8 used for the Supercritical Wing 
on its right, the X-29 forward-swept wing demonstrator, built partly on its 
success, to its left. 
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HUGH L gtTOW__ 
FLIGHT RCSCARCH CCHTtH 


Chapter Eight: The Impact and Legacy of NASA's 
Digital Fly-By-Wire Project 


1 1' light research is done] "to separate the real from the imagined.'' 

— Hugh L. Drydcn 1 

NASA spent over 15 years finding out what was real about digital fly-by- 
wire technology. The research program achieved important goals: it proved 
that active control could be accomplished with digital systems and that 
multiple computers could be synchronized and provide a greater measure of 
flight safety. It also demonstrated many other ideas, such as adaptive control 
laws, sensor analytic redundancy, and new methods of flight testing digital 
systems remotely. Drydcn Flight Research Center proactively spread the 
word about the results in these research areas and helped stakeholders in the 
commercial application of the technology reach common ground on certifica- 
tion of digital systems. The digital fly-by-wire project contributed to the 
development of control technology and has a place in history there as well. 
The NASA experiments expanded the volume of engineering knowledge and 
made it applicable to other domains of control. Finally, the project also hail a 
lasting impact on the Center itself through its alumni and the techniques they 
pioneered. 




Airbus's adoption ot llybywire lor its cotrenercial transports is the ultimate prool thai Ore 
objectives ol the NASA program were met. In the 1980s. I he A320 was Ihe lirsl commercial 
application, with Olliers tallowing n the 1990s. (Phota courtesy Airbus Industrie ol North 
America. Inc.) 

Hugh L. Drydcn. ’Cicncnl Ba.-kgn.axl ol the X- 15 Retouch Airplane Propel." in tUuanh-AOplant. 
CammUttr Rtf *#) on Cmfeient eon rtr Piir/itiiof the X-IS Prafta (Hunplnn. VA: Langley Aeronaut!- 
eat Latxniory. 25 26 Oct 1956). xix. 
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Technology Transition 


The F-8 project team members used several avenues to deliver informa- 
tion about fly-by-wire to the outside world. They also did not neglect internal 
technology transition. Ken S/alai held a series of in-house seminars on active 
flight -control and redundancy management in 1979. summarizing for others 
at Dryden what the new technologies were and how to use them. As noted 
above, the software development process acquired from the Draper Labora- 
tory as early as Phase 1 of the program provided the foundation for later 
software efforts at the Center. 

The F-8 program had a significant number of publications. The bibliogra- 
phy compiled for the 20" anniversary of the first flight lists 41 key papers 
directly reporting results from the project. 1 These papers first came out as 
early as the first flight research period and nearly continuously after that. The 
content and results of the Phase I flights were well documented in several 
papers given at a NASA-sponsored conference on fly-by-wire in 1974.® 

Papers arc passive in that one hopes people pick them up and read them. 
Workshops are a more active way for the results of the program to be trans- 
mitted. especially if key organizations are invited to send representatives. 
Dryden and Draper Lab offered a "Workshop on NASA Advanced Flight 
Control Systems Experience” at the Los Angeles Airport Hilton on 20 to 22 
June 1978. The briefing slides show that they reviewed the feasibility aspects 
of Phase 1. then the activities of Phase II. The purpose was to transition to 
aerospace corporations enough detail about the technology to encourage its 
application. At that time, there were already over 60 technical reports from 
the program, and the attendees received pointers to them for more informa- 
tion than the three-day briefing provided. This workshop was repeated in 
Cambridge. Massachusetts, at Draper Lab. This was the period that the F-18 
development was underway, resulting in considerable industry interest in 
digital flight controls. 

The presenters gave insights about flight software development, the 
newest and most daunting of the technologies. They reported that during the 
software construction phase, "transformation of design into code (was) more 
artistic than the hardware build." This is not what a nervous engineer consid- 
ering digital fly-by-wire wants to hear, but such people were reassured by the 
fact that software defects discovered in post-flight analysis did not cause 
trouble in the air. Redundancy and self-testing provided shields from defects, 
as did the use of restarts for transient fault protection without even needing to 
know the source. There were only eight input/output errors in one billion 
operations by mid- 1978. a statistic that also gave confidence to potential 

! Proceeding* of the F-S Dt/tuil Fty -By-Wire and Supennmal Win# Fun Fllflni 20^Anomnaiy 
CfiAnttkm (Edwutk, C\: NASA Confemee Ptfclicuion 3256. 27 May iWl. Volumt II. 

' Detcrtptton and Flt/tUi Ten Uriahs of the NASA F-S Ih/aal FI , -By-Wee Caniroi Synem (Edwanlt. CA: 
NASA IN D-7M3. Feh 1975). 
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adopters of the technology ‘ 

Some military programs immediately applied the lessons of the F-8 
project. General Dynamics looked at both the F-4 and F-8 conversions into 
active control aircraft and gained enough confidence to make the F-16 fly- 
by-wire from its inception. 5 Lockheed's F-l 17A and Northrop's B-2 both 
could not fly unless active controls could be used, as their differing stealth 
technologies dictated unstable shapes: a flat-panel angular fuselage and a 
flying wing, respectively. All these projects arc of 1 970s origin and directly 
benefited from fly-by-wire research. The remotely augmented vehicle system 
is the ancestor of the Highly Maneuverable Aircraft Technology (HiMAT) 
flight-control system and all later remotely piloted vehicles. There are plans 
for unpilotcd fighters to accompany piloted strike aircraft of similar design to 
provide less expensive escorts and bulk up attack groups without endanger- 
ing humans. These aircraft would draw from the same control technology 
proved by the F-8 in the 1970s. 



Dissimlar stealth technologies characterize Ihe F-117A and the B-2. but Ity-by-wire is needed by 
both. (U S. Ait Face pholo). 


The Certification of Commercial Flv-By-Wire Airliners 

It was clear that the main stumbling block to the use of fly-by-wire in 
commercial transports was the certification of them by the U. S. Federal 
Aviation Administration ami its international counterparts. Early in the 
1980s. Boeing introduced two airliners with advanced avionics: the 757 and 
the 767. Even though the company had built a prototype cargo airplane using 

* "Workshop on NASA Admitted Right Control Systems Expcrttittc.' teicfing slide*. Dryden Might 
Research Cemer History Office. 

* Tttt early models of Uk F- 1 X used digital fly-by -wire, hui tin aircraft was sralttaUy stable and thu* 
earned only limited benefits. 
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a lly-by-wirc and hydromcchanical system in the mid-1970s." neither of the 
two new airliners had digital technology in their controls. 

It was left to the relatively young Airbus to make the leap into the future 
and challenge Boeing’s domination of the narrow-body airliner market with 
an advanced airplane using a flight-control architecture different from the 
American prototypes. Conscious of potential resistance by certifying agen- 
cies. pilots, and the flying public. Airbus engineers devised a scheme that is 
both redundant and a reduced-functionality backup at the same time. The 
objective was to introduce as much diversity in the system as possible (and 
thus avoid the dreaded generic software defect that could bring down all the 
computers) yet provide functional redundancy. 

There arc two separate control systems in Airbus lly-by-wirc aircraft 
(which now include the models A3 18, A3 19. A320. A321. A330, and A340). 
These work together to provide highly optimized handling in the pitch and 
roll axes. (The yaw axis still uses a mechanical system.) One is called the 
ELAC (Elevator Aileron Computers) and the other the SEC (Spoiler Elevator 
Computers). Thomson-CSF built the ELAC system, using two different 
computers, one designed in Paris, the other in Toulouse, by different teams 
not in contact during development/ In addition, the SEC. built by SFENA. is 
triply redundant. In order to achieve even higher reliability, the software is 
written in different languages, such as assembler unique to the processor. PL 1 ’ 
\ 1 . and Pascal.' 

If one or the other system fails completely, the remaining one becomes 
the backup. It is quite possible to fly an Airbus using spoilers for ailerons, 
and also without the spoilers, but the elevator control is built into both 
systems because that is still the primary control surface for pitch, and any 
other arrangement would not do. This rather Byzantine system is claimed to 
have a reliability of about one failure in 10 trillion operations, the highest 
ever achieved. 

Boeing finally built an airliner with fly-by-wire controls, the 777. The 
control system is more straightforward than that used by Airbus. It contains 
three "lanes" of three different computers each: an AMD 29050, a Motorola 
68043. and an Intel 80486. 10 Boeing is reportedly discovering one little- 
anticipated problem with choosing fly-by-wire: all the computer manufactur- 
er. supplying the processors arc trying to stop new fabrication of these older 
machines. Now it is faced with a choice of buying up sufficient number, of 

* Calkd VC- 14.. two were built hy Boeing lor the US. Air Porte. Intended lor .hurt Held lakenll and 
lulling!. the uirtruav wu. unstable do: to to unu.ual placement ol tfv engines »el! leeward on the upper 
curtate ol the wing to ttut the exhaust cculd enhanee lift. First llown iw 9 Aug. 1976. it had a mccfumcal 
cisuiol system with a triplex digital stability augmentation system. i.John K. Wimp rest and Conrad F. 
Newberry . The tC- U STOL /’mrorype | Rcton. V A: American In.tittte at Aereeuuuts and Autonomies. 
1998). pp. 43-46. give an account of the system nod the evolution i< its redundancy management l 
Etienne TanonAy. Autus. telephone interview. 4 Feb 1998. 

■ Pierre Conlim. Systems lor «e Airtiu. A.i3l - Innovation in all directions." /VTEfctVM. 4(1 1 1985): iS3. 
“tantowsiiy. interview. 

" John Apt in. ' Prltiuty Flight Computer, tor the Diving TT7." manuscript, p. 4 
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the remaining production to outfit all projected 777s. both new and those in 
need of repair, or of trying to re-host the software, which also means recerti- 
fication. 

Since software is so difficult to certify. NASA tried to share its develop- 
ment experiences to help airplane companies and government agencies begin 
to work together on the problem. In 1976. NASA's Ames Research Center 
co-hosted a conference with the Federal Aviation Administration (FA A) on 
certifying flight software, in which members of the F-S team participated. 
Attendees advised the FAA not to get into the business of certifying the 
software itself, but rather whether the functionality is present. 11 That treats 
hardware and software components as equals. The F-8 team made other 
contributions to the FAA's understanding. When Earl Dunham of Langley 
Research Center conducted additional lightning tests in late 1977. the FAA. 
which was worried about lightning and fly-by-wirc. was briefed in detail on 
the results. ’’ Cal Jarvis noted after that meeting that the FAA’s only experi- 
ence w ith digital systems consisted of certain autopilots, which had a reliabil- 
ity requirement with no clear sense of how it would be proved. He found out 
that the FAA had 50 test pilots, only about 30 of whom knew anything about 
digital systems, and only about 10 of whom could read block diagrams. 

Jarvis sensed that perhaps the FAA inhibited advanced designs because of its 
outdated certification requirements and lack of training among reviewers." 

Since then, there has been an evolution of recommendations for software 
development and verification. The latest (since 1992) is D0178B. an interna- 
tional standard that certifying agencies can require, as did the FAA in Advi- 
sory Circular 20-1 15B. Essentially. DOI78B contains guidelines, not require- 
ments. that can result in a disciplined software development process if 
followed. The process is similar to that for the F-8 and Shuttle programs, but 
it docs not appear to be more complete or to have any innovations. Unfortu- 
nately, DOI78B is only meant to show "intent.'' rather than giving clear 
direction. 1 * The requirements list indicates what to do. not how to do it. This 
means the interpretation of what has to be done versus what is suggested to 
be done is discovered in FAA certification hearings with commercial airplane 
companies. There precedent is set and argued. 

The F-8 Digital Fly-By -Wire Project in the History of Technology 

The story of the development of fly-by-wire lies in both the history of 
aeronautics and the history of computing, and it contributes to the overall 
history of technology. Early chapters of this book gave the context of fly-by- 

" NASA. "tVivcmmmi'Iniiuviry WaUop on Methods lor the Cerlificaion cd Digital Flight Controls 
md Avionics" (Moffcit Held. CA: TMX-73. Oci 1976). p 9. 

11 Calvin Jusis notebook*. 20 Dec. 1977: 23 lin 1978. 

"Calvin lusts notebook*. 14 Mar. 1978. 

" Leslie A. Schod. "DO- 1 78B: Software Cansidtiaiioa* in Airborne Systems and Equipment Cettifka- 
lion.” maamciift, p. 4. 
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wire in aeronautics and computing. The common theme is the maturation of 
the ability to control. Aeronautical engineer, employed computers in flight- 
control systems not because they represented a new technology and were 
"progress for progress” sake." but because they were part of a solution to the 
tlight-control problem. The development of NASA's first digital llight- 
control system did have some aspects of the application of interesting new 
technology just because it was new, but the program rapidly matured into a 
technology demonstrator for the exploration of many new techniques. 

Control was always a part of using machines. The development of 
automatic feedback control enabled dramatic achievements. Control can be 
defined as "purposive influence toward a prc-determined goal." Commonly a 
program, which is any pre-arranged information that guides subsequent 
behavior, is needed to guide the system in achieving the goal. In early 
feedback control systems, such as Edmund Lee’s use of fantails on windmills 
beginning in 1745. the program was encapsulated in the hardware. 15 This is 
similar to how analog computers cany their programming. The invention in 
1822 of a cam to control the lathing of military gunstocks automatically used 
the same technology as the differential analyzer (a mechanical analog 
computer) did a century later. More recently the program has resided in 
software. 

The ideas about control matured in the last century and a half. For Max 
Weber, the study of control meant the study of bureaucracy. Other social 
scientists and politicians followed this line of research and application, 
including Karl Marx. Vladimir Lenin, and Joseph Stalin writing about and 
experimenting with controlled economics. Right after World War II the focus 
changed. Since "information processing and communication arc inseparable 
components of the control function." the increasing variety and availability 
of computers caused them to become intimately entwined with the concept of 
control. 16 Their information-processing role is obvious, and Claude Shannon 
gave the theoretical basis for the communication theory that is most useful in 
feedback control. 17 

Norbert Wiener invented the term “cybernetics" in 1948 to represent 
control and communication in animals and machines. His vision of automatic 
factories displacing workers caused great unrest among those likely to be 
replaced. Technologists loved and laborers scorned the word "automation." 

In 1953. feedback control systems were in highly automated factories, and by 
1959 a Texaco refinery and an Imperial Chemical Industries processing plant 
used digital control systems. Some envisioned a "second industrial revolu- 
tion" due to automation. 1 ' 

" lute R Ba^a. Iht CxnvJfU iMlmw (CmfrtJgc. MA: Hmvwl Uniwrutv FYcu. ISW.1 pp ». 17ft. 

" lino R Bcrijis. fir Ctormtf fru/Amiu |*< ft & 

1 Chain Suukiikl. 6toiAvituikAv* Jit/ioab«Y (BullinKiic: John* Hopkn. Umvrnily Prc«. 19731, [p. 55-59. 

" June* R Hn.'hl 'Tti- Devrkym-n rt Atimulion" in Mthin Kun/hap .mJ Cirril W. PuiwU. Jr. edi. 
Techtalogi rtt UV.vvm Oubcdnai l.Nca Vert: Oxfofd Unlvcnity Prov l'»7 1 pp. ft<5-655. 
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In the 1950s, digital computers could be used in the role of factory 
controllers simply because factories were generally large places w ith plenty 
of room for the mainframes of the day. Dedicated control of smaller compo- 
nents. such as individual machines, had to wait for computers to shrink in 
size and yet increase in power. The demands of aircraft and spacecraft 
designer* helped drive these developments. Integrated circuit manufacturers 
increased capability, quality, and production when the Apollo and Minutcman 
missile programs bought almost the entire supply of chips for several years in 
the early 1960s. By the time the engineers of the F-8 project adopted the 
Apollo Guidance Computer, the technology was in place for small, powerful, 
digital machines suitable for flight control in both aircraft and spacecraft. 

What These Engineers Knew and How They Knew It 

Walter A. Vinccnti. an aeronautical engineer turned historian of technol- 
ogy. wrote a scries of essays published in What Engineers Know and I low 
They Know It. The book examined developments in aeronautical engineering 
as a demonstration of how engineers gain knowledge. 1 ’' People think of 
engineering practice as a fairly straightforward application of known facts 
derived from scientific principles and designs from previous similar types. 
For instance, any bridge has the functional characteristics of all bridges, and 
the engineer's skill and creativity is exercised handling the variables such as 
the needed length and type of traffic. The stones in the book show engineers 
in the nascent aeronautical field often proving and refining ideas by experi- 
mentation. Every bndge is the culmination of knowledge gained from 
thousands of years of building successful bridges. Every airplane is the 
culmination of less than a hundred years of building successful airplanes. 
There arc very few bridges and relatively many airplanes built at the edge of 
engineering knowledge. The role of engineers practicing at the forefront is to 
gain facts and techniques for their successors' use. This requires a different 
view of engineering work. 

The NASA engineers at the Drydcn Flight Research Center actively seek 
out projects that expand aeronautical engineering knowledge. They cither 
invent or adopt promising new technologies, explore them, derive lasting 
principles, and transition this new common knowledge to other engineer*. 

The technique, no longer new. becomes pan of the practicing engineer’s 
toolkit. 

Fly-by-wire technology for flight control was not entirely innovative 
when Melvin Burke decided his team would work on it in the late 19W)s. 
However, it was hardly in wide use by flight-control engineers, and. there- 
fore. a prime candidate for a project at Drydcn. The Air Force was already 


■* Waller A. Vm-cntl Hluir tj/finec/i Afn.ni amt Hm Ihr, Know h (Batiimvc: lohns Hopkins 
University Pres*. IXVOl 
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exploring ihe use of analog computers as the basis of such systems, abandon- 
ing digital computers after some work early in the decade. Because of how 
funding was allocated, the ostensible focus of the Air Force effort was 
surv ivability: fly-by-wire as a means to an end outside the flight-control 
problem. NASA could take a broader focus on maturing the technology for 
its own sake, while still keeping the eventual goal of a control-configured 
vehicle in mind. 

NASA actually doubled the impact of digital technology. Piloted and 
unpiloted spacecraft and launch vehicles used digital computers for all 
aspects of flight control. Commercial launch-service providers and satellite 
builders now routinely use the technology in their vehicles and spacecraft. 
Similarly, commercial and military aircraft manufacturers now employ 
digital fly-by-wire. It has reached the point where designers of new military 
airplanes would hardly consider any other flight-control system. Within a few 
years this will also be true of civilian aircraft intended for commercial use. 
From both the standpoint of expanding engineering knowledge and of 
NASA’s mission, the F-8 Digital Fly-By- Wire project is a success. 

The Technological Legacy 



The AFTli'F-16. (Photo courtesy ol Lockheed Martin], 


One follow-on project began even before the F-8 retired. It was the 
Advanced Fighter Technology Integration ( AFT1VF-16. As the initial flights 
of the F-8 helped lead General Dynamics to an analog fly-by-wire system for 
the F-16A/B, flights of the AFTIF-16 (at Edwards Air Force Base with 
Dryden participation) led the firm to a digital fly-by-wire control system. 

One interesting function added due to the capability of the digital system was 
speech recognition and the capability for automatic recovery if the pilot lost 
consciousness due to maneuvers. 

Perhaps the closest successor to the F-8 in the role of avionics pioneer is 
the F/A-18 Systems Research Aircraft. NASA maintains a licet of F-ISs as 
chase aircraft, the replacements for the F-I04s. Some researchers at Dryden 





had the bright idea of pulling experiments on one of the F-18s to lake ad van- 
tage of Us frequent flight time. When word got around to avionics manufac- 
turers that such a capability was available, the airplane garnered so much 
business that it is used in the experiment mode full-time. It pioneered fly-by- 
light. the use of fiber optic connectors, and the replacement of heavy central- 
ized hydraulic systems with smaller units like electro-hydrostatic or electro- 
mechanical actuators that were also less susceptible to electromagnetic 
interference, battle damage, and a high incidence of maintenance than what 
they replaced . 31 

When Center Historian John '‘Dill" Hunley asked Ken Szalai about 
important follow-on projects to the F-8. his reply took a different direction 
than flight control.' 1 He highlighted the Digital Electronic Engine Controls 
(DEEC) and the Highly Integrated Digital Electronic Control (H1DEC) 
programs. They did for engine controls what the F-8 project did for flight 
controls. In fact, their impact was more rapid and greater than flight controls 
themselves. They borrowed from the F-8 project its control law algorithm 
structure, its computational requirements, and its redundancy management. 
Commercial airplanes without fly-by-wire flight controls had engines with 
digital controllers. The pervasiveness of this technology is nearly complete. 
The certifying agencies like it because of its elegance and inherent redun- 
dancy: no commercial turbo fan- powered aircraft has fewer than two engines. 
There arc also the High Anglc-of-Attack Research Vehicle (HARVl that 
pioneered thrust vectoring and the F-15 ACTIVE (Advanced Controls for 
Integrated Vehicles) that continued the work. Szalai pointed out that digital 
controls arc not much affected by sand. wind. dust, and humidity, making 
them ideal for military and commercial applications. 

More generally, as alluded to elsewhere in this study, the F-8 Digital Fly- 
By-Wire program served as the springboard for digital fly-by-wire technol- 
ogy to be used in both military and commercial aircraft. As already noted, 
the concern in the early 1970s was that digital fly-by-wire was just too 
complex and unreliable for piloted aircraft. Dryden's program demonstrated 
that this was not the ease. As a result, not only the second-generation F-16 
flight-control system became digital, but the first-generation F/A- 1 8s adopted 
a digital flight-control system. Later, commercial transports like Airbus and 
the Boeing 777 adopted digital flight control as well, as noted above in this 
chapter. 

The Human Ix-gacv 

The F-8 program was a fertile source of leadership for the Dryden Fight 
Research Center. Taking a snapshot of where some of the key pilots and 

’Lane E. Wallace, ofOiamrn (Wufcingba. DC: NASA SP-4J09. I 'mi. 124-126. 

11 Kenneth S/alai. ulervKn -ith Jot* Dill' Hunley. Divtlen Fight Research Carter. 2 1 July 1998. 
“Frank Huehev. uoovtcv*. Jet* von Space Center. Ilcuvton. TX. 2 June 198.V 




engineers were al ihc end of July 1998 shows a significant number of alumni 
in important positions. Ken S/alai was Director of the Center. Kevin Petersen 
was Deputy Director, soon to be named Acting Director and then Director 
following Szalai's retirement on 1 August. Jim Phelps had recently headed 
the safety office before retiring. Dwain Deets commuted back and forth to 
NASA Headquarters as the Manager of the Research and Technology Flight 
Research Program, which encompasses most of the projects at Dryden and 
proposals for the future. Gary Krier returned to Dryden in 1995 and by 1998 
led the Aerospace Projects Office. Cal Jarvis retired from that same position 
and in 1998 lived nearby. Tom Mc.Vlurtry had been the Director for Flight 
Operations until 27 July 1998. when he became the Center’s Associate 
Director for Operations. The successor to Krier as project pilot. Steve 
Ishmael. was the X-33 Deputy Manager for Flight Test and Operation. Pilots 
Ed Schneider and Rogers Smith also had significant levels of responsibility, 
w ith Schneider becoming the Acting Chief of the Flight Crew Branch and 
Smith, the Acting Director of Flight Operations on 27 July. Wilt Lock and 
Joe Wilson were '‘engineers’ engineers." albeit senior to most of the others at 
Dryden. They birth seemed more comfortable with engines and electronics 
than politics and budgets. 

What can be deduced from this impressive list? Tire most obvious 
common characteristic among almost all of these men while they worked on 
the F-8 is youth. They were mostly in their 20s and 30s. and. with a few 
exceptions, were playing a major role in a program for the first or second 
time. In many ways they resembled the teams that made up the Apollo 
Pro ject: young engineers, often right out of school, w ith seemingly limitless 
confidence and energy. NASA people who worked on Apollo and stayed with 
the agency for twenty years or more hold the fondest memories for that 
frantic period and time of their life.” In interviews for this book, there often 
was a similar sense of nostalgia and accomplishment among the F-8 DFBW 
alumni. However, if for many of those immersed in Apollo the rest of their 
careers seemed anti-climatic, this is not true of the F-8 engineers. They went 
on to several more projects before many of them landed on the administrative 
floor of Center Building 4800. each with challenges comparable to those of 
the lly-by-wire program. The F-8 achieved a major milestone in the history 
of technology when it Hew with a digital computer. This is like the first lunar 
landing: a culmination, a defining moment. The program did not pioneer fly- 
by-wire. and by the time the Phase II flights began, the YC-14. the F-18. and 
several projects in England and Germany were either in the air or soon to he 
with multiple digital-control systems. Therefore. Phase II was an opportunity 
to experiment, to refine, to convincingly prove digital lly-by-wire was 
practical for many applications. This made the project similar to others at 
Dryden that had no moment where an historical marker could be placed, but 
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which resulted in reams of data and practical experience. These were the 
projects the members of the F-8 team peopled in the 1980s and early 1990s. 
These arc the projects in which Lock and Wilson still toil, separating "the 
real from the imagined.*’ 


i:s 



Appendix: DFBW F-8C Flight Logs 


Nine: The flights ait numbered xxx-yyy-m. where xxx is the munbei of lie flight since 
NASA acquired the aircraft, yyy is list- number of flights since it was converted to fly-by - 
wire, and /jj. is the number of the flight in Phase II. Use aiivraft had 37 general familiariza- 
tion flights piio« to convention. The Phase I flight numbers do not contain the /://. element 
for obvious reasons. 

Phase I 


Date 

Number 

Pilot 

Objective 

Remarks 

25 May 1972 

38-1 

Gory Kner 

Fust flight 


8Jun 1972 

39-2 

Guy Kner 

Envelope expansion 
and evaluation of 
DFBW and BCS 
systems 


19 Jan 1972 

40-3 

Gary Kner 

Knvelope expansion 
and evaluation of 
DFBW and BCS 
systems 

-Stick gearing 
evaluation 

18 Aug 1972 

41-4 

Gary Kner 

Evaluation of SAS 
modes and new Mick 
gearing 


22 Aug 1972 

42-5 

G»y Kner 

Evaluation of SAS 
mode and new slick 
gearing 

•SAS gave smoiMher 
takeolf 
-Landing had 
nuiginal control in 
SAS im&les 

15 Sep 1972 

43-6 

Gary Kner 

Evaluation of SAS 
modes and new Mick 
gearing 

-Observed delay in 
roll between com- 
mand and response 
-Tape leader mat tune 
lion 

21 Sep 1972 

44-7 

Tun MeMuitiy 

Pilot checkout and 
evaluation of SAS 
modes and new Mick 
gearing 

-Tnin indicators 
reported insensitive 
-Plane tended toward 
lateral and diieelioual 
PIO 

27 Ud 1972 

45-8 

Gary Kner 

New K-STARTtape 
and BCS evaluation 


3 Nov 1972 

46-9 

Gary Kner 

New K- ST ART. CAS 
and RRC evaluation. 
BCS Slick Gearing 

-"Problems" listed as 
weak radio and left 
main gear indicator 















6 Die 1972 

m 

19 Due 1972 

10 Jan 1973 

30 Jan 1973 

13 huh 1973 

16 Mat 1973 

23 Mji 1973 

29 Mji 1973 

6 Apr 1973 

6 Apt 1973 

1 May 1973 




Evaluation 

inop 

•BCS pilch avis now 
lias non linear LVDT 

47-10 

Tom MuMurlry 

Evaluation of SAS. 
CAS. arid BCS 


48-11 

Gary Krlur 

Evaluation of SAS. 
CAS. and BCS 


49-12 

Gary Krlur 

Evaluation of SAS. 
CAS. and BCS 


50-13 

Tom MeMunry 

Evaluation of SAS. 
CAS. and BCS 


51-14 

Gary Krlur 

Performance 
comparison with 
SCW. handling 
qualities in GCAs, 
and CAS evaluation 


52-15 

Gary Krlur 

Stability and control 
maneuvers 


53-16 

Gary Krlur 

Slaballly and control 
maneuvers and 
tracking 


54-17 

Tom MuMurlry 

Slabalily and control 
maneuvers and 

tracking 

•Focus on pitch 

55-18 

Gary Krlur 

Stability and control 
maneuvers and 
tracking 

•Focus on pitch 
•More tracking tasks 

56-19 

Tom MuMurlry 

Stability and control 
maneuvers and 
tracking 

-Yaw problems 
cccur v» ilh lateral 
inputs 

•Pilot notes that 
plane wanders in 
lateral axes 
•TM signals kssl in 

night 

H 

Gary Krlur 

Stability and control 
maneuvers and 
tracking 

•Problems w ith BCS 
self test 

•Problems w ith the 
primary system in 
roll 

58-21 

Gary Krlur 

Stability and control 
maneuvers 

•TM signals kssl. 
terminating some 
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maneuvers 






•Smooth landing 
•Damped lateral 
control 

8 May 1973 

5922 

Gary Kner 

Low speed handling 
quail lies 


29 May 1973 

60-23 

Gary Krier 

Stability and control 
maneuvers 


4 lun 1973 

61-24 

Tien McMurtry 

Low speed handling 
qualities 


7 lun 1973 

62-25 

Tun McMuitiy 

Low speed handling 
qualities 

-Servo warning 
lights appear early in 
High! 

•Problems with 
lateral -directional 
characteristics of 
anplane 

-Oscillations prevent 
laigct ainsjwd 
maintenance 
-Pilot experiences 
downmoding 
problems 

22 lun 1973 

63-26 

Guy Krier 

Stability aixl control 
maneuvers 

-Airplane is 
reluctant to roll in 
and out ol turns 
■Some oscillatory 
and deviation 
problems 
•Pilot stales that 
lateral control was 
significantly 
improved 

26 lun 1973 

64-27 

Tun McMuitry 

Stability aixl control 
maneuvers 

-Obvious overshoots 
when making bank 
angle changes 
•High pilot 
workload 

•Yaw wandenng and 
lateral sensitivity 
- Tracking problems 

3 Jul 1973 

65-28 

Guy Krier 

Stability and control 
maneuvers 

-Detailed data 
eolleetion aixl rating 
ol maneuver 
perform ante 




































10 Jul 1973 

66 29 

Gary Krier 

Stability and control 
maneuvers 

-Pikst seems h> have 
liouhle nth Inm in 
certain inode/gcar 
gaiii combinations 

24 Jul 1973 

67-SI 

Toni McMutry 

Stability' and control 
maneuver* 

•Focus cm longiiudi 
nal handling 
qualities 

19 Sep 1973 

68-31 

Gary Krier 

Evaluation of lime 
sensing and s»de- 
itkk 

•Firsl 1 light with a 
slick on the side ol 
pilot as opposed hi 
the center 

25 Sep 1973 

69-32 

<«*y Kriii 

Evaluation of lime 
sensing ami sidc- 
slick 

-Firsl appearance is! 
tlx- "Side Slick 
Mission Rules 
Docunwm" 

3 On 1973 

70-33 

C ia«y Krier 

Evaluation ol luiee 
sensing and skle 
slick 

-Pilot prevented 
hum performing 
some maneuvers due 
to wind lunitalions 
tlial appear on the 
"Mission Rules 
Documeni" 

4 Oil 1973 

71-31 

Toni McMurtn' 

Evaluation of lime 
sensing side -stick 

-Winds again 
prevent certain 
iivane users in night 
and reduce the 
altitude in (light 

12 On 1973 

72-35 

Tom McMutry 

Evaluation of luiee 
sensing siile -slick 

•Crew appears to 
grow accustomed to 
wind limitations, 
now given alternate 
plans according to 
wind conditions on 
llighl instructions 

17 Oil 1973 

7336 

Tom McMurtry 

Side-slick evaluation 


24 Oil 1973 

74-37 

llnl Oeslrichx 

Pilot cheefcout 

-Favorable report 
from print: he is 
impressed by the 
DFBW crew and Ilk- 
quality of the 
airplane 

24 Oil 1973 

7338 

llnl Oestiich* 

Pilol checkout 

-Pilot perforins 
vamvus maneuv ers 
and formation 
exercises 























































1‘ll.n checkout 


ft Nov 1973 

77-40 

Bill Uina 

Pile* checkout 

•Various general 
evaluations 
-Alterations made to 
"Mission Rules 
Document" 

19 Nov 1973 

78-41 

Einar 

Enevuklson 

Pilot checkout 

•Pilot evaluates 
primary conlml 
sydem 

27 Nov 1973 

79-42 

T. K.(Km) 
Mattingly 

Control system 
evaluation 

-Overall evaluation 
ot all systems anil 
side-stick 


Phase 11 


Date 

Number 

Pilot 

Objective 

Remarks 

27 Aug 1976 

H 

Ciary Krier 

Evaluation of DFBW 
primary and bypass 
systems. 

•CBS roll sell test 
tailed, causing a 
slartoser of all 
predighls. 

17. Sep 1976 

81-44-2 

Clary Krier 

Envelope expansion 
aid living ifualities 
evaluation. 

•Flight was aborted 
due to channel A 
computer failure, 
caused by CPU 
parity error, but the 
lirsl 9 test points 
were completed. 

28 1 ait 1977 

82-45-3 

Ciary Krier 

Flight ted using 
refurbished AP- 101 
computers. 

-Precautionary 
landing made due to 
1 computer 1 allure: 
landing made on 
remaining 2. 

16 Feb 1977 

83-46-4 

Clary Krier 

Evaluation ol digital 
augmentation and 
autopilot modes. 


25 Feb 1977 

84-47-5 

Ciary Krier 

Expansion of 
augmented and 
unaugmented 
envelope. 

















































2 Mai 1977 


14 Mar 1977 


AJiliiioiul envelope 
expansion and 
handling qualities 
evaluation. 


Pilot lainiliari/ation 
with Phase II system 
and autopilot 
evaluation. 



Altitude hold 
misl unction due to 
an altitude gyro 
ahnomialilv. 


IK Mar 1977 


Evaluation ol Shuttle 
back-up (light- 
control system 
sollvvare test package 
with E-S living ALT 
tree llighl profile fll. 


21 Mar 1977 


Evaluation ol Shuttle 
back up flight - 
control system 
sollvvare test package 
with E-S Hying ALT 
free llighl profile # 2 . 


22 Mar 1977 


Evaluation of Shuttle 
back-up (light - 
conlrol system 
sollvvare test package 
with E-S Hying .ALT 
free llighl profile #5. 


22 Mar 1977 


14 Apr 1977 91-54-12 


14 Apr 1977 


Gary Kner 



Ev aluation of Shuttle 
back-up llight- 
control system 
sollvvare test package 
with E-S Hying ALT 
lice llighl profile f4. 


Evaluation of Shuttle 
experimental 
soHware package 
with ALT free flight 
profile t 2 . 


Tom Me Murin' Evaluation of Shuttle 
experimental 
software package 
with ALT free flight 
profile # 1 . 


15 Apr 1977 93-56-14 



Evaluation of Shuttle 
experimental 
soHware package 


■Pilot notes that 
pilch stsck forces 
were unpleasantly 
high. 


• Flight was 
postponed twice 
because ol failing 
mil axis computer 
by pass self-test. 











































» ith ALT free Might 
profile * 2 . 


Evaluation ol Shuttle 
experimental 
software package 
w ith ALT Iree Might 
profile #5. 


Control system 
envelope expansion 
and open kxip RAV 
checkout. 



•Flight wa* 
originally scheduled 
for May I7lh. hut 
cancelled due to 
mode panel 
sw Itching problem*. 
• Problem* with 
Mach and altitude 
indicator*. 


Control system 
envelope expansion 
and open kxip RAV 
checkout. 


•At end of testing, 
straight-in landing 
made due to "engine 
low oil pressure" 
light illumination. 


Handling sjuality 
investigation oil the 
F-S mode* at 20.000 
ft with speed range 
of 300-400 KIAS. 
with additional open 
loop maneuvers. 


Additional RAV 
testing done alter 
the Might. 


Handling tpialily 
investigation oil the 
F-S modes at 20.000 
ft arid speed range of 
300-400 KIAS. with 
additional open loop 


-Flight termination 
due to computer 
failure indication 
shortly alter lakeulf. 
-Flight wa* 
originally scheduled 
for earlier dale, but 
channel A failure 
caused abort. 


Handling ipialilie* 
evaluation of various 
DFBW control 
modes, evaluation of 
automatic angle -of- 
attack limiter system. 
I‘ formation flight 
for Phase 11. and 
engagement of RAV 
mode. 


-Substantial AP 101 
problems existing in 
last several Mights: 
many still 
outstanding. 

-Flight wa* 
previously aborted 
due to lailure in 
analog CBS system. 
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Sep 1977 


15 Sep 1977 


2 Dec 1977 106 69-27 


18 Jan I97X 107-70-28 


Cary Krxer 

Evaluation ol 
handling qualities 
and ancient-attack 
limiter, energy 
maneuverability, and 
RAV engagements. 

Tom McMurtry 

linvelope expansion 
lor SAS aisd CAS 
modes, handling 
qualities evaluation, 
and maneuver llap 
tests. 

Cary Kiser 

Evaluation ol ride 
smoothing system. 

Tom McMurtry 

Evaluation ol ride 
smoothing system. 

Cary Krser 

Evaluation of ride 
smoothing system. 

Cary Krser 

Investigation of 
autopilot control 
modes and perlor- 
manev ol Mall 
approach maneuver. 

Cary Krser 

Evaluation of 
operation of angle- 
ot attack limiting 
system, control 
augmentation 
sollware. and 
gathering data on 
longitudinal trim 
changes. 

Cary Krser 

IVrltsnnaiKe of 
seises of lateral- 
directional pulses, 
and investigation of 
longitudinal slick 
characlenMics list a 



-flight terminated 
early due to channel 
BAP- 101 failure. 
By-pin system 
correctly "by- 
passed'' had 
computer. Problems 
were delegated to 
IBM for investiga- 
tion. 


Because of the 
objective, lest 
occurred in 
alternoon with 
severe turbulence. 


-Moderate levels of 
turbulence. 


Light turbulence. 


•Excessive workload 
in trim SAS and 
CAS: pilot believed 
this was due to stick 
shaping and 
sensitivity problems. 



-Inoperative 

communication 

antenna. 









































17 Feb 1978 109 72-30 


Gary Krxrr 


proposed new 
location lor the 
primary pilch LVDT. 
Abo evaluation ot 
RAV mode, handling 
quailin'' in line lions 
and lomialion flight, 
gunsighl trucking. 


RAV evaluation, 
envelope e.vpoision 
for ride smoothing. 
Ilap derivative 
senes, lomialion 
Hying evaluation, 
gunsighl trading, 
pitch command 
LVDT sensor 
evaluation. 


RAV evaluation, ride 
smoothing evalua- 
tion. laieral- 
dircvlional evalua 



-Lateral response 
seemed "too 
sensitive - to pilot. 
•New parabolic stick 
shaping in software 
release improved 
roll response aiound 
center stick. 


•RAV handling 
qualities were 
"inferior" to basic 


SAS mode. 



8 Mar 1978 


12-75-33 


Gary Krier 


■evaluation ol 
handling qualities 
using new tape 
release mlcmied to 
improve roll 
response, and RAV 
evaluation using 
ground playback 
pulse utilizing 
uplink, lisnnalion. 
gunsighl tracking, 
and rxle smoothing. 


Roll handling 
qualities evaluation, 
altitude hold mode 
evaluation. Ionisa- 
tion living character 
i st ics. and gunsighl 
tracking. 


RAV evaluation ol 3 
pilch filters and 
pulse playback, 
autopilot evaluation, 
lormation and 
tracking. 


•First flight to be 
“pulsed" by pilot 
with pulses recorded 
and "play ed back" to 
the F-K. 

-Bank angle control 
was "significantly 
improved over all 
previous flights." 


-Roll conlml was 
further improved. 
•Lateral axis in 
formation improved. 


•Filters allowed 
quicker response 
coming out of 
deadband than basic 
CAS mode. 
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24 Mar 1978 


25 Mar 1978 


27 Mar 1978 



7 Apr 1978 


10 Ape 1978 


II Ape 1978 


14-77-35 





l oin McMurliy 

Lvalualion of 
transport delay and 
sample rale w ilh 
RAV mode, center 
slick and side-stick 
for landing approach 
task with wing down 
(simulate Shuttle 
approach). 

Gary Krier 

Lvalualion of 
transport delay and 
sample rale w ilh 
RAV mode, center 
slick and side -stick 
for landing approach 
task with wing down 
(simulate Shuttle 
approach). 

L. Lnevolihon 

Pilot familiarization 

John Manke 

Pilot familiarization 

Tom McMurtiy 

Lvalualion of elicit 
of transport delay in 
pitch and roll axis for 
formation task and 
approachdanding 
task. 

Gary Krier 

Lvalualion ofell'ect 
of transport delay in 
pitch and roll axis for 
formation task and 
approachdanding 
task. 

lunar 

lincitildstm 

Lvalualion ofellecl 
of transport delay in 
pitch a ixl roll axis for 
fomialion task and 
approach'landing task 

John Manke 

Lvalualion ofellecl 
of transport delay in 
pitch and roll axis for 
fomialion task and 
approach'landing 
task. 


-Landing gear dixies 
n moled In allow 
higher approach 
speed, which caused 
vibration and loss of 
TM signal to RAV. 


•RAV disengage 
caused I g pill. 



-Landing task was 
high-energy w ing 
down approach. 


•Landing task was 
high energy wing- 
down approach. 
-Delays varied from 

20 to 200 msec. 

•Metronome signals 
used in frequency 
response attempts. 


-Landing task was 
high-energy wing- 
ikiwn approach 


-Landing task was 
high-energy w ing- 
down approach 
•Turbulent air caused 
alpha light to 
illuminate, forcing 
software to configure 
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12 Apr 1978 

121-84-42 

Tom McMurtry 

Evaluation ofeffect 
of transport delay in 
pitch and roll axis lor 
formation task and 
approaclvlandmg 
task. 

12 Apr 1978 

122-85-43 

Gary Krier 

Evaluation of effect 
of transport delay in 
pitch and roll axis tin 
formation task and 
apptuaclvlanding 
task. 

14 Apr 1978 

123-86-44 

Linar 

Encvtildstni 

Evaluation of eflecl 
of lrans|xut delay in 
pitch and roll axis lor 
formation task and 
apptuaclvlanding 
task. 

17 Apr 1978 

124-87-45 

Joint Manke 

Evaluation of eflecl 
of transport delay in 
pilch and roll axis for 
formation task atxl 
approaclvlatxlmg 
task. 

IS Apr 1978 

125-88-46 

Joint Manke 

Evaluation of eflecl 
ol transport delay in 
pitch and roll axis (or 
formation task atxl 
appmaclvlaixlmg 
task. 

19 May 1978 

126-89-47 

Tom McMurtry 

Evaluating delays for 
improved CAS atxl 
SAS in formation 
task. 

25 May 1978 

127-90-48 

Linar 

Enevoldsint 

Evaluating delays for 
SAS and improved 
CAS In loniulKvn 
task. 

1 Jun 1978 

128-91-49 

Linar 

Enevoldstni 

Landing task using 
improved CAS or 
SAS. 

1 Jun 1978 

129-92-50 

Gary Krier 

Landing task using 


to a fixed let of 
conditions. 

-Landing task was 
high-energy w ing 
down approach 
•Wing and gear were 
down for all 
approaches. 

-Landing task was 
high-energy wing 
down approach. 
-Wing and gear were 
down for all 
approaches. 

-Landing task was 
high-energy w ing 
down appetxich. 

IX- lays of 20.60, 
and 100 msec. 

-Landing task was 
high-energy w ing 
down approach. 
Wing fuel problems 
were noted. 

-Landing task was 
high-energy w ing 
down approach. 

- No fuel present in 
wings. 

-Flight postponed to 
this day because of 
dragging brake 
pucks. 



-Simulated relucting 
task also performed. 


Simulated relueling 
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improved CAS in 
SAS. 


Id Jun 1978 

1 30-93-5 1 

Gary Krier 

Evaluated effect of 
lowering control law 
sample rale utilizing 
RAV. 

29 Aug 1978 

131-94-52 

Gary Krier 

Evaluated low sample 
rale (RAV). 

1 1 Sep 1978 

132-95-53 

Tom McMurtry 

Evaluated low sample 
rale (RAV). 

20 Sep 1978 

133-96 54 

Tom McMurtry 

Evaluated low sample 
rale (RAV). 

26 Sep 1978 

134-97-55 

Finat 

linevotdsim 

Evaluated low sample 
rale (RAV). 

3 CXI 1978 

135-98-56 

Tom McMurtry 

Evaluated low sample 
rale (RAV). 

10 CXI 1978 

136-99-57 

Finar 

Enevoldsim 

Evaluate low sample 
rale (RAV). 

17 CXI 1978 

137-100-58 

Ciary Krier 

RAV monitor 111. lor 
RAV adapt 

24 CXI 1978 

138-101-59 

Gary Krier 

RAV monitor 111. lor 
RAV adapt 

25 CXI 1978 

139-102-60 

Ciary Krier 

RAV adaptive 111. lest 

3 Nov 1978 

140-103-61 

Gary Krier 

RAV adaptive 111. lest 

8 Nov 1978 

141-104-62 

Gary Krier 

RAV adaptive 111. lest 

14 Nov 1978 

142-105-63 

Gary Krier 

RAV adaptive 111. lest 

15 Nov 1978 

143-106-64 

Gary Krier 

RAV adaptive 111. lest 

20 Nov 1978 

144-107-65 

Gary Krier 

RAV adaptive 111. lest 

21 Nov 1978 

145-108-66 

Sieve Islunael 

Pilol checkout 

21 Feb 1979 

146-109-67 

Gary Krier 

Vibration data on 
pallet 

28 Feb 1979 

147-110-68 

Gary Krier 

Vibration data on 
pallet 


last also performed. 
-CAS appeared lo bt 
mom responsive Ilian 
SAS. 


-Handling became 
worse as sample rale 
decreased. 



-Cutnpuler channel 
"A" failed. 


•Previous abort due 
lo RAV problems. 







-Computer B failure, 
generator failure. 
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’6 Sep 1979 


31 Oci 1979 


21 Nov 1979 


27 Nov 1978 


29 Nov 1979 


7 Feb 1980 


9 Jun 1980 


9 lun 1980 


1 1 Jun 1980 


17 Jun 1980 


19 Jun 1980 


23 Jun 1980 


3 Jul 1980 


17 Jul 1980 


21 Aug 1980 


4 Sep 1980 


5 Sep 1980 


Sep 1980 


148-1 1 1-69 

Sieve Ishmael 

ARM High! evalua- 
tion. 

149-112-70 

Sieve Ishmael 

ARM llight evalua- 
tion. 

ISO- 113-71 

Sieve Ishmael 

ARM llight evalua- 
tion. 

151-114-72 

Sieve Ishmael 

ARM llight evalua- 
tion. 

152 115-73 

Sieve Ishmael 

ARM llighl evalua- 
tion. 

153-116 74 

Sieve Ishmael 

ARM llighl evalua- 
tion. 

154-117-75 

Sieve Ishmael 

PIO transport and 
delay evaluation. 

155-118-76 

Sieve Ishmael 

PIO transport and 
delay ev alualiim. 

156-119-77 

Einar 

Enevoldvon 

PIO transport and 
delay evalualiim. 

157-120-78 

Tom McMurlrv 

PIO transport and 
delay evalualiun. 

158-121-79 

Sieve Ishmael 

PIO transport and 
delay ev alualiim. 

159-122-80 

Sieve Ishmael 

PIO transport and 
delay evalualiim. 

160-123-81 

Sieve Ishmael 

PIO transport and 
delay ev alualiim. 

161-124-82 

Sieve Ishmael 

PIO transport and 
delay ev alualiim. 

162-125-83 

Sieve Ishmael 

PIO Iran spoil and 
delay evalualiim. 

163-126-84 

Sieve Ishmael 

PIO transport and 
delay evalualiim. 

1M-127-85 

Sieve Ishmael 

PIO transport and 
delay ev alualiim. 

165-128-86 

Sieve Ishmael 

PIO transport and 
delay evalualiim. 


•Computer l-ilked in- 
night. 






Maneuvering llight. 








•ICS generator failed 
al 17.00011. 














































































24 Sep 1980 

166 129-87 

Mike Swarm 

Checkout 111. 

2 Oct 1980 

167-130-88 

Mike Swann 

PIO transport and 
delay evaluation. 

15 CXI 1980 

168-131-89 

Mike Swann 

PIO transport and 
delay evaluation. 

24 CXl 1980 

169 132-90 

Mike Swann 

ARM 111. evaluation. 

29 CXI 1980 

170-133-91 

Sieve Ishmael 

ARM 111. evaluation. 

31 CXI 1980 

171-134-92 

Mike Swann 

PIO transport and 
delay evaluation. 

9 Mar 1981 

172-135-93 

Sieve Ishmael 

ARM 111. evaluation. 

1 1 May 1981 

173-136-94 

Sieve Ishmael 

PIO transport and 
delay evaluation. 

13 May 1981 

174-137-95 

Mike Swann 

PlOvgynt data. 

20 May 1981 

175-138-96 

Sieve Ishmael 

PlOs (bending 
plallonn evaluation). 

22 May 1981 

176-139-97 

Mike Swann 

PIOv 

28 May 1981 

177-140 98 

Mike Swann 

PIOv 

1 1 Jun 1981 

178- 141 -99 

Tom McMurtry 

ARM. 

24 Jun 1981 

179-142-100 

Sieve Ishmuc! 

ARM. 

17 Jul 1981 

180-143-101 

Sieve Islunucl 

ARM. 

30 Jul 1981 

181-144-102 

Sieve Ishmael 

PICK 

31 Jul 1981 

182-145-103 

Sieve Ishinac! 

PICK 

4 Aug 1981 

183-146- 104 

Tom Mc Murtry 

PICK 

5 Aug 1981 

184-147-105 

Sieve Ishmael 

PIOv. 



•Channel ••A" 

transient. 


•Maneuvering lit., 
channel "A - ' transit 
( 2 ). 



New gyro problem. 


-Transient tail-" A” 
replaced ”A“ 
platform gyro. 


Relumed early 
because i*l an 
apparent Him 
problem. 


Aeruman-loop. 


•Computer “C* fail- 
S/N08. 


-Relumed early 
became <«1 TM 
problem on airplane. 



•Channel "A" 
transient. 
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1 1 Aug 1 VK 1 

185-148-106 

Tom McMurtry 

PlOs; slab, and 
control. 

14 Aug 1981 

1X6- 149- 107 

Steve Ishmael 

PlOs; slab, and 
control. 

7 Dec- 19X1 

1 87-150-108 

Steve Ishmael 

Checkout lit. lor A/C 
systems pt>« to new- 
pilots living the A/C. 

X Dec 19X1 

I XX- 1 5 1 - 109 

Bud Isles 

General evaluatxm lit. 

14 Dec 19X1 

1X9-152-110 

Major Harry 
He imple 

General evaluation m. 

X Jan 19X2 

191-153- 1 1 1 

Dick Gray 

General evaluatxm III. 

21 Jan 19X2 

191-154-112 

Dick Gray 

General evaluatxm lit. 

2 Feb 19X2 

192-155-113 

Trim McMurtry 

CADRK checkout 111. 

9 Feb 19X2 

193-156-114 

Steve Ishmael 

CADRE evaluatxm. 

19 Feb 19X2 

194-157-115 

Steve Ishmael 

CADRE evaluatxm. 

1 Mar 19X2 

195-158-116 

Einar 

llnevolihon 

CADRE evaluatxm. 

X Mar 19X2 

196-159-117 

Tom McMurtry 

CADRE evaluatxm. 

9 Mar 19X2 

197- 160- 1 IX 

Tom McMurtry 

CADRE evaluatxm. 

16 Apr 19X2 

198- 161-119 

Dick Gray 

Fuel prole check 
Bight. 

6 May 19X2 

199-162-120 

Dick Gray 

PlOs- Fuel probe with 
Navy A-6. 

13 May 19X2 

■i 

Dick Gray 

PlOs. 



Grumman forward 
swept wing pilot. 


-AFTl/F- 16 pilot, 
roll "B" dec: rt. mil 
"B" transient reset 
•OK.- 

•Computer channel 
**C" (S/N05) 113 
alarm (CPU main 
storage parity error!. 


•Returned early 
because ol "B" bus 
problem. 



- During pro Bight 
"B" attitude gyro 
problem, recycle 
power OK. Channel 
"A" transient aliei 
landing. 



Navy A 6 abort mi 
returned early 
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Dick Gray 

PIOs (A-6). 

Dick Gray 

PIOs (A-6). 

Dick Gray 

CADRE 3 evaluation. 

Dick Gray 

CADRE 3 evaluation. 

Steve Ishmael 

CADRE 3 evaluation. 

Dick Gray 

CADRE 3 evaluation. 

Dick Gray 

CADRE 3 evaluation. 

Rogers Smith 

Familiarization lit. 

Rogers Smith 

Familiarization lit. 

Rogers Smith 

CADRE 3 evaluation. 

Rogers Smith 

CADRE 3 evaluation. 

Rogers Smith 

CADRE 3 evaluation. 

Rogers Smith 

CADRE 3 evaluation. 

Ed Schneider 

Familiarization lit. 

Rogers Smith 

Optimal inputs. 

Ed Schneider 

Optimal inputs. 

Rogers Smith 

CADRE 3. Phase 2. 


without accomplish- 
ing objective. 


Minot problem with 
roll ”B" elec, right 
roll servo during 
pte Might. OK during 
Might. 


•Minor problem with 
rtdl "B" elec, right 
roll servo during 
pre Might. OK during 
Might. 



•Channel "A" 
transient 2 limes in 
Might. 


•Channel ~C failure 
in lliglat. 


•During prelll. lound 
yaw limit problem. 



-T.VI dropouts in 
system 2 . 


1 7 Mar 1 983 218- 1 8 1 - 1 39 Rtigers Smith CADRE 4. Phase 2 


22 Mar 1983 219 182 140 Rogers Smith CADRE 4. Phase 2 
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22M84-142 

Roger' Smith 

CADRE 5. Phase 2. 

222-185-143 

Ed Schneider 

CADRE 5. Ph»e 2. 

223-186-144 

Rogers Smilh 

CADRE 5. Phase 2. 

224-187-145 

Ed Schneider 

CADRE 5. Phase 2. 

225188146 

Ed Schneider 

CADRE 5. 1’haie 2. 

226- 189- 147 

Ed Schneider 

CADRE 5. Phaic 2. 

227-190148 

Rogers Smilh 

Functional check 111. 
and laniiliari/alioa. 

228-191-149 

Ed Schneider 

Fumiliuri/alion 111. 

229-192-150 

Ed Schneider 

Optimal inpul ;iw«- 
menl. 

230-193-151 

Ed Schneider 

Optimal inpul assesi- 
menl. 

231-194 152 

Ed Schneider 

REBUS checkout arid 
lumiharualinn 111 . 

232-195-153 

Rogers Smilh 

REBUS checkout and 
lamiliarualion 111 . 

233-196-154 

Ed Schneider 

REBUS 111. 3. 

234-197-155 

Rogers Smilh 

REBUS 111. 4. 

235-198 156 

Rogers Smilh 

Lai. dn. handling, 
qualities (LDHQI. 

236-199-157 

Ed Schneider 

LDHQ. 

237-200-158 

Ed Schneider 

REBUS Hi. 5. 

238-201-159 

Rogers Smilh 

OPTRE 

239-202-160 

Rogers Smilh 

OPTRE 

240-203-161 

Rogers Smilh 

OPTRE 


problem, system 
“A" 


lell engine during 
>ii mb out — relumed 
lo bane with no tlila. 
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12 Mar 1985 

241-2114162 

til ScllIXUdet 

OPTRE 

-No wing fuel. 

12. Mar 1985 

242-205- 163 

lul Schneider 

OPTRE 

-No wing fuel. 

13 Mar 1985 

243-206-164 

Rogers Smith 

OPTRE 

-No wmg fuel. 

13 Mar 1985 

244-207- 165 

Rogers Smith 

OPIRE 

-No wmg fuel. 

19 Mar 1985 

245-208-166 

Rogers Smith 

OPIRE 

-No wmg fuel. 

26 Mar 1985 

246-209-167 

Rogers Smith 

OPTRE 


m 

247-210-168 

til Schneider 

RlfiUS 111. 6. 

•No wmg fuel. 
-Alterburnei 
problems noted. 

16 Dec 1985 

248-21 1-169 

til Schneider 

Functional check flight. 

Aileron leel system 
modification lor this 
1 light. 
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Glossary 


Actuator— a mechanical device that moves some other component on command. 

Ailerons— surfaces, usually on the trailing edge of the wings, that control rolling an 
airplane. 

Airfoil — a wing or other surface that provides lift. 

Amplitude— the vertical range of an oscillation. 

Analog — something that models something else; in analog flight-control computers, 
an electronic circuit that solves equations of motion that model aircraft maneuvers. 

Area-role— a way of shaping an airplane’s fuselage that reduces drag. 

Analytic Redundancy Management (ARM)— a method of redundancy management 
by analyzing and fusing data colleetcd from different non-redundant sensors. 

Attitude controller— a short control stick for commanding a change in the position of 
a spacecraft relative to its direction of flight. 

Automatic interception interface— the interface between a ground control radar 
station and a fighter interceptor. 

Avionics— electronics used in aircraft. 

Backup Control System (BCS)— the analog flight computers and their associated 
actuators, in the case of the F-8 Digital Fly-By-Wirc aircraft’s Phase I configuration. 

Ballistic— the essentially parabolic path taken by an object when it has been acceler- 
ated and then the acceleration ceases. 

Baseline loop— the length of time devoted to a cycle in a control system. 

Boolean function— a mathematical function that returns a reading of either ’’true’’ or 
"false." 

Breadboard— a prototype of a computer or other electronic device built by the design 
group to test the deviee before it is packaged for production. 

British "Oboe"— a methtxl of guiding bombers to their targets via a directional radio 
beam. 

Canards— horizontal lifting and control surfaces placed in front of the wings. 



Centerline air scoop— an air intake for a turbojet engine mounted in the center of a 
fuselage. 

Command Augmentation System (CAS)— an automated system for controlling the 
flight-control surfaces, used only in the pitch axis on the F-8. It could predict and 
smooth out pitch oscillations. 

Compiler— a computer program that accepts statements of a high-level language as 
input and generates machine code that will execute those statements as output. 

Computer By pass System (CBS) — the hackup analog computer-based flight-control 
system used in Phase II of the F-8 project. 

Control law s— aircraft equations of motion encapsulated in cither analog circuits or 
software. 

Ctucifonn tail — the stabilising surfaces of an airplane arranged in the shape of a 
cross. This arrangement of horizontal and vertical stabilisers is the most common 
among all aircraft. 

Damper— something that reduces oscillations. 

Delta wing— the triangular shaped wing used on many jet aircraft, often w ithout any 
horizontal tail surface as a stabiliser. 

DIR —the direct control mode of the fly-by-wire system. 

Discrete-circuit transistorised computer— a computer constructed of individual 
transistors and other electronic components instead of integrated circuits. 

Discretes— values that signal an event or a state. 

Downlink— the radio connection used to send information from an aircraft or 
spacecraft to tire ground. 

DSKY (Display and Keyboard Unit )— a component of the Apollo spacecraft that 
enabled input and output to the computer system. One was used on the F-8 during 
Phase I of the fly-by-wire research program. 

Drag— the resistance on an aircraft caused by moving through the air. 

Dynamic stability — stability maintained by a flight-control system. 

Effectors— devices that act on oilier devices or perform some service. 

Egon — see Gentian "Egon." 

Electrical analog device— a circuit that models behavior. 
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Elc valors— control surfaces that move an aircraft in the pitch axis. 

Fault tolerance— the ability of a device to function after a failure. 

Fixed gain stability augmentation system— an augmentation sy stem that uses a single 
set value to condition inputs. 

Fixed-point arithmetic— the representation of numbers using an immovable decimal 
point. 

Right pallet — the platform on which the computer* and other devices could be 
mounted for installation in the airplane. 

Floating-point arithmetic— the representation of numbers using a movable decimal 
point. 

Fuselage— the body of an aircraft. 

g — a force equal to that of the gravity of the Earth at sea level. 

g tolerance— the ability to withstand force on the body or on a structure caused by 
aircraft maneuvering. 

Gain — a predefined coefficient that is applied in the control laws of a fly-by-wire 
aircraft to affect the sensitivity of the results of a command. The values of the gains 
could be altered in softw are and a range of gains could he selected using rotary 
sw itches on the mode control panel. 

Gate— a logic device. For example, an AND gate returns the result of a Boolean 
AND operation on its inputs. 

German "Egon"— a method of guiding bombers to their targets via a directional 
radio beam. 

Gimbal— a device with two axes of rotation in which a gyroscope is mounted. 

GCA (Ground controlled approach)— a method of guiding an aircraft to the rnnway 
in bad weather using radar and a controller who radios instructions to the pilot. 

Gyroscope— a rotating device that provides a reference for instruments and imparts 
stability. 

Hardovcr— the rapid deflection of a control surface to its physical stopping point. 

High gain model following— a method of monitoring performance by comparing 
actual values to optimal predicted values. 

High-g cockpits— cockpits designed to help pilots withstand g forces. 
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Horizontal stabilizer— an airfoil, usually mounted toward the tail, that often provides 
downward forces to help halance an aircraft On a fly-by-wire aircraft, it can be a 
lifting surface instead. 


Inner loop— a real-time control program sometimes has fixed time periods for the 
execution of blocks of software. These periods are usually of differing lengths, and 
the shortest is the inner loop. 

Instability— the lack of ability to remain stable. 

Integrated circuit— an electronic circuit containing many transistors and other 
components installed on a small silicon wafer. 

Integrated engine/flight controls— controls that can affect both the engine and control 
surfaces together, such as throttle control and flap deployment on an approach. 

Integrator— an electronic circuit that performs the integration operation of the 
calculus. 

Interceptor— a fighter designed to find and destroy enemy aircraft. 

Interface— the connection between two devices for the exchange of data. 

KECO— the cooling system used in the Phase I flight pallet to keep the electronic 
devices within temperature limits. 

KIAS (knots indicated air speed)— the aircraft speed shown on an instrument in the 
cockpit, uncorrected for the effects of wind and often expressed in terms of nautical 
miles per hour. 

K-START— the name of the contents of the magnetic tape used during Phase I that 
contained the constants and additional software for a specific flight. 

Lateral stability— the ability to maintain wings-lcvcl flight. 

Learning algorithm subsystem— a control program that automatically changes its 
output based on information gained during its operation. 

Lift — the upward force prov ided by airfoils mov ing through the air. 

Linear variable differential transformer (LVDT)— a device that converts physical 
force into a proportional voltage. 

Logic circuits— electronic circuits that represent some Boolean equation. 
Longitudinal stability— the ability to remain stable in the pitch axis. 

Lyapunov model reference technique— a mathematical technique used to monitor 
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performance by comparing actual values to optimal predicted values. 

Mach— the aircraft velocity relative to the speed of sound. 

Majority logic voters— circuits that return a value based on examining inputs and 
choosing the one that represents the majority. 

Moekups — non-functional models, often actual si/e. that make it possible to check 
component positions, sizes, w iring lengths, etc. before committing to a final design. 

Model tracking— a method of prediction arrived at by monitoring how well some- 
thing follow s a model of its motion, then projecting future activity. 

Monoplanes— airplanes with one set of wings. 

Ncwton-Raphson technique— a mathematical technique used to monitor performance 
by comparing actual values to optimal predicted values. 

NOR operation— a Boolean operation that negates the result of an OR operation. 
Thus, if the inputs to a memory chip were one. one. and zero, the output of the 
integrated circuit would be zero. 

OPTRF. (Optimum Trajectory Research Experiment)— a Phase II flight experiment 
that involved testing data uplink and downlink between the F-8 and a computer in 
the new Remotely Piloted Vehicle Facility. 

OR— a Boolean operation in which if any of the inputs arc ones, a one is the result. 
Oithogonal— in a perpendicular direction. 

Outer loop— a real-time control program sometimes has fixed time periods for the 
execution of blocks of software. These periods are usually of differing lengths, and 
the longest is the outer loop. 

Pilot-induced oscillation ( PIO) — what happens when a pilot tries to do a maneuver 
but uses too much force on the controls and the aircraft overshoots the desired 
attitude: then if the pilot tries to recover from this, but overcoirects. thus forcing 
even more recovery cycles, the condition is called a PIC). The current terminology is 
"airplane-pilot coupling.” 

Piston-driven airplane— an airplane powered by a reciprocating engine similar to that 
used by an automobile. 

Pitch axis— the axis about w hich the nose of an airplane appears to move up and 
down. 

Pitch evaluation — maneuvers to test a control system's stability in the longitudinal 
axis. 
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REBUS (Resident Backup Software)— a means of providing softw are safety by 
including a kernel capable of controlling the aircraft as a backup w ithin the full load 
of software. 

Recursive least-squares approach— a mathematical technique used to obtain optimal 
predic ted values. 

Redundancy — the duplication of components so that a failed one can be ignored and 
the (light continued using the duplicates. 

Remotely Augmented Vehicle (R.AV) mode— a procedure in which the control laws 
arc executed on the ground and the commands sent up to the aircraft. 

Roll axis— the axis around w hich an airplane appears to rotate. 

Roll steps— maneuvers in which test pilots make rolls but stop at interv als instead of 
smoothly rotating through the entire axis. 

RRC (Roll Rate Control)— a mode only selectable while using the Command 
Augmentation System, which only worked in the pitch axis; RRC nevertheless gave 
additional control in the roll axis. 

Rudder— a control surface that helps move the airplane in the yaw axis. 

Rudder pulses— maneuver by which test pilots make short pushes on the rudder 
controls to check stability in the yaw axis. 

Sample rates— the number of separate v alues returned by a sensor in a fixed time. 

Sensor analytic redundancy management — schemes for figuring out which one of the 
sensors returning different values is correct. 

Sensors— devices that measure things like airspeed, attitude, and acceleration and 
return values to the control system. 

Sensor suite— the set of sensors on a particular aircraft. 

Servo— a device that executes commands from the control system and moves other 
devices. 

Side-stick controller— a control device mounted on the side of the cockpit rat Ik r than 
in the center. 

Simplex- with-baekup— a single control string with a dissimilar system as an alter- 
nate in case of failure. 

Single-string— a system consisting of only one of every needed component. 
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Slider valves— devices in an hydraulic system that move in response to pressure 
changes. 

Sperry flight-control equipment— analog computers and other control devices 
developed by the Sperry company. 

Stability augmentation system (SAS)— a mode that provides automatic help to a pilot 
to maintain control in gusts and to reduce the probability of pilot induced oscilla- 
tions. 

Stealth— the ability of an aircraft to avoid radar detection. 

Swept-wing— wings mounted at other than a 90-degree angle to the fuselage. 

Telemetry — signals sent from an aircraft or spacecraft to the earth containing data 
gathered or generated by experiments and flight hardware. 

Three-channel redundant analog computer— a computer system using analog circuits 
in which all arc triplicated for redundancy. 

Thrust— force generated by an engine. 

Titan booster— a roeket used to launch piloted and unpiloted eaith satellites. 

Trim control— a device that enables small control surface deflections to maintain an 
aircraft in a desired attitude by compensating for changes in the position of the center 
of gravity and winds. 

Uplink— the transmission of signals from live ground to a vehicle in flight. 

Variable gains— different selectable values for conditioning inputs. 

Variable stability— stability that changes from one type to another as effected by the 
control system. 

Ventral — mounted downward. 

Vcrtical stabilizer— a stabilizing surface mounted mostly perpendicular to a horizon- 
tal stabilizer or wing. 

Voters— devices that return the value of the majority of a set of inputs. 

Wing root — the mounting point of a wing. 

Wind tunnel — a device that accelerates air past a model of an aircraft (or in some 
cases, an actual aircraft) for research and development purposes. 

Yaw axis— the axis about which the nose of an airplane appears to move side to side. 
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